An S3 bucket in account A stores objects encrypted with a customer managed KMS key in account A. A role in account B needs direct GetObject access without assuming a role in A. No explicit denies apply. Which TWO permission changes are required? (Choose TWO.)

1. Allow the role in the bucket policy and grant s3:GetObject for those objects in the role's identity policy.
2. Grant the role kms:Encrypt but not kms:Decrypt in its identity policy.
3. Enable S3 Versioning to automatically share the objects and their encryption key.
4. Replace the customer managed key with the AWS managed aws/s3 key and share that key across accounts.
5. Allow the external role to use the KMS key for decryption in the key policy and grant kms:Decrypt in the role's identity policy.