A company engaged a third party to audit several AWS accounts. Cross-account IAM roles were created in each target account. The auditor is unable to access some of the accounts. Which of the following could be causing this issue? (Choose three.)

When assuming a cross-account IAM role, several factors must be correct for the operation to succeed. An incorrect or missing external ID will prevent role assumption, as it's a security best practice to prevent confused deputy attacks. If the auditor's IAM entity (user or role) lacks the sts:AssumeRole permission on the target role's resource, they cannot assume it. Finally, the Role ARN uniquely identifies the role to be assumed; if it's incorrect or malformed, the AssumeRole API call will fail. The auditor's password and secret access key are irrelevant for assuming a role, as role assumption uses temporary credentials. While an EC2 role can assume another role, the statement "must be set to the destination account role" is vague and not a direct cause of failure in this context.