A developer deploys an application on EC2 instances in Account A. The application must read from an existing Amazon Kinesis data stream in Account B. Which actions are needed to grant the application access to the stream? (Choose two.)

To enable cross-account access for the EC2 instances in Account A to read from a Kinesis stream in Account B, you need to configure an IAM role in Account B that grants permission to read from the stream. This is the "resource account" role. Then, you must establish a trust relationship. The trust policy of the role in Account B must explicitly allow the instance profile role from Account A (the "principal account" role) to assume it. This allows the EC2 instances, through their instance profile, to temporarily take on the permissions of the role in Account B, gaining access to the Kinesis stream. Incorrect options: Adding stream read permissions directly to the EC2 instances' instance profile role in Account A is insufficient because the Kinesis stream resides in Account B, and cross-account access requires a role in the resource account. Adding a trust policy to the instance profile role in Account A is not the primary mechanism for granting cross-account access; the trust policy belongs on the role being assumed (in Account B). Attaching a resource-based policy to the Kinesis stream is an alternative for cross-account access, but the question asks for two actions, and the described IAM role assumption is a common and robust pattern.