A cross-account deployment consumes SSE-KMS artifacts from a central bucket. Which authorization layers should the engineer verify? Select 2 answers.

1. The intended role assumption and S3 object access policies permit the artifact reads.
2. The central bucket is made publicly readable to bypass KMS authorization.
3. Only the artifact filename contains the destination account ID.
4. Only s3:ListAllMyBuckets is granted to every account principal.
5. The customer managed key policy or grants and relevant IAM permissions permit the necessary decryption.