A SysOps admin is using IAM credentials to upload an object to a customer’s S3 bucket named DOC-EXAMPLE-BUCKET but receives AccessDenied. Which combination of changes will resolve the permission failure? (Choose two.)

To resolve an AccessDenied error for an S3 PutObject operation, both the identity (the SysOps administrator's IAM user) and the resource (the S3 bucket) must explicitly grant permission. Option 1 is correct because attaching an IAM policy directly to the SysOps administrator's IAM user provides the necessary identity-based permission to perform s3:PutObject on the specified bucket. Option 2 is correct because adding a bucket policy to DOC-EXAMPLE-BUCKET grants resource-based permission for the SysOps administrator's IAM principal to perform PutObject. Either an identity-based policy or a resource-based policy (or both, as long as neither explicitly denies) can grant access. The other options are incorrect: Attaching permissions to the IAM user without modifying the bucket policy might still result in AccessDenied if the bucket policy explicitly denies access or doesn't allow cross-account access. Modifying the customer account's root user or the SysOps administrator account's root user is generally not a best practice for granting specific application-level permissions and is overly permissive. Root user credentials should be used sparingly.