A company wants to manage access for several engineers through one policy assignment. Which TWO steps provide the normal group-based approach? Select TWO.

1. Add the engineers to an appropriate IAM group
2. Give every engineer the same private API key
3. Write a policy granting that group the required permissions
4. Assign the group to a fault domain to create permissions