An analysis job runs as an IAM role in account A. It needs temporary read access to a role named ReportReader in account B. ReportReader already has the required S3 read permissions. No SCP or permissions boundary denies the operation. Which TWO configurations are required? (Choose TWO.)

1. Enable public read access on account B's S3 bucket.
2. Configure ReportReader's trust policy to allow the job's role in account A to assume it.
3. Create an IAM user in account B and copy its access keys to the job.
4. Allow the job's role in account A to call sts:AssumeRole on ReportReader's ARN.
5. Attach a policy allowing iam:PassRole to the job's role and make no trust-policy change.