A security engineer is using Amazon EC2 Image Builder to create an AMI. The pipeline is configured to deliver build logs to an Amazon S3 bucket. When the pipeline runs, the build fails with the error: "AccessDenied: Access Denied (403)." The engineer must fix the issue following least-privilege best practices. Which combination of actions will meet these requirements? (Choose two.)

The build failure with "AccessDenied: Access Denied (403)" indicates that the EC2 instance performing the build lacks necessary permissions. The EC2 instance profile associated with the Image Builder pipeline is the correct entity to grant these permissions, not the security engineer's IAM role. The policies EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore provide the foundational permissions for Image Builder to function and for SSM to manage the instance during the build process. Additionally, since the logs are delivered to an S3 bucket, the EC2 instance profile needs s3:PutObject permission on that specific S3 bucket to write the logs. Attaching AWSImageBuilderFullAccess is not least-privilege. Granting the security engineer's IAM role S3 permissions is incorrect because the EC2 instance, not the engineer, is performing the S3 write operation.