A role in account A must decrypt data using a customer-managed KMS key in account B. Which permissions are required?

1. Only a VPC peering connection between the accounts.
2. Only an IAM allow in account A, regardless of the account B key policy.
3. Only knowledge of the key alias name.
4. Appropriate permission in the key policy and in the caller account IAM policy.