A role is trusted by an external account for a supported cross-account operation. The external user still cannot assume it. What should be checked?

1. Only the target VPC DNS settings.
2. Whether the external account knows the root password of the target account.
3. The role trust policy and the external caller authorization to invoke sts:AssumeRole.
4. Only the target role description, because trust automatically grants caller permissions.