A company shares a KMS-encrypted S3 dataset from account A with an analytics role in account B. The bucket policy permits the role, but reads fail at decryption. What additional authorization is required?

1. Permit the supported KMS decrypt use in the key policy and the caller account IAM policy.
2. Grant ListBucket only because it also grants KMS decryption.
3. Create VPC peering between the two accounts and remove IAM permissions.
4. Share only the KMS alias string with the analytics team.