Account A stores PII in a DynamoDB table named PII. An application running on EC2 instances in Account B needs access to that table. In Account A an IAM role AccessPII was created with permissions for the PII table and a trust policy allowing principals from Account B to assume the role. Which steps should developers perform in Account B to enable the application to access the PII table? (Choose two.)

To enable cross-account access, the EC2 instance role in Account B needs permission to assume the AccessPII role in Account A. This is achieved by adding an sts:AssumeRole permission to the EC2 instance role's policy, specifying the ARN of the AccessPII role as the resource. Once this permission is in place, the application running on the EC2 instance can programmatically call the AWS Security Token Service (STS) AssumeRole API. This API call, made using the EC2 instance role's credentials, will return temporary security credentials (access key ID, secret access key, and session token) for the AccessPII role. The application then uses these temporary credentials to make authorized calls to the DynamoDB PII table in Account A. Granting direct permission to the EC2 instance role to access the PII table in Account A is incorrect because cross-account access is managed through role assumption, not direct resource policies. Using the EC2 instance role's credentials directly would only grant access to resources within Account B, not Account A. GetSessionToken is used to obtain temporary credentials for an existing IAM user or role within the same account, not for cross-account role assumption.