A SageMaker processing role can list an S3 bucket but cannot read SSE-KMS-encrypted training objects. What should be checked?

1. Make all training objects public instead of fixing scoped access.
2. S3 object-read permission and the required KMS decrypt authorization for the role.
3. Only the training learning rate.
4. Only the notebook theme.