An application running on Amazon EC2 pulls messages from Amazon SQS. After recent IAM changes, the instances can no longer receive messages. Which actions should you take to troubleshoot while maintaining least privilege? (Choose two.)

The two correct actions focus on verifying permissions at different levels, adhering to least privilege. First, you should verify that the instance role's attached or inline policies grant the necessary SQS permissions (e.g., sqs:ReceiveMessage) for the target queue. This ensures the role itself has the required access. Second, you must confirm that the SQS queue's resource policy does not explicitly deny the instance role. An explicit deny in a resource policy overrides any allow permissions, making it a critical check. Attaching an MFA device is irrelevant for an EC2 instance role. Verifying the access key is unnecessary; EC2 instances use temporary credentials via IAM roles, not long-lived access keys. Attaching AmazonSQSFullAccess violates the principle of least privilege by granting more permissions than required.