A knowledge base service role can read its S3 source, but an OpenSearch Serverless-backed ingestion fails with access errors. Which layers should be checked?

1. Only the user prompt wording.
2. Only the generator output temperature.
3. Make every organizational collection publicly writable.
4. The service role permissions, collection data access policy, and applicable network and encryption access.