A company organizes its AWS accounts into organizational units (OUs) within AWS Organizations. APIs deployed in one account are bound to that account's VPC and currently have no authentication. Only principals from a specific OU should be allowed to call the APIs. The company applied a policy to the API Gateway interface VPC endpoint and updated the API Gateway resource policies to block calls that don't come via the interface endpoint. After this, invoking an API through the interface endpoint URL fails with the error: "User: anonymous is not authorized." Which combination of actions resolves this issue? (Choose two.)

The error "User: anonymous is not authorized" indicates that the API Gateway is not receiving valid authentication information. To resolve this, two actions are needed. First, enabling IAM-based authorization on every API method by configuring AWS IAM as the authorizer ensures that API Gateway expects AWS credentials for authentication. Second, authenticating and verifying callers by signing client requests with AWS credentials using Signature Version 4 provides the necessary authentication information. This combination allows the API Gateway to identify the caller and apply the resource policies correctly. Incorrect options: Token