An engineer launched an EC2 instance in a VPC private subnet (the VPC has no public subnet). The instance runs code that should send messages to an Amazon SQS queue, but the queue receives no messages. The subnet uses the default network ACL and the instance uses the default security group, with no changes. Which of the following could explain the issue? (Choose two.)

The EC2 instance needs an IAM role with permissions to send messages to SQS. Without appropriate IAM permissions, the instance cannot interact with SQS, regardless of network connectivity. Since the instance is in a private subnet with no public subnet, it cannot access SQS over the public internet. An interface VPC endpoint for SQS is required to allow private communication between the EC2 instance and SQS within the AWS network. The default security group allows all outbound traffic, so it wouldn't block SQS communication. The default network ACL allows all inbound and outbound traffic, so it wouldn't block return traffic. The subnet route table would automatically route traffic to the SQS endpoint if one were configured, or to the internet gateway if the subnet were public.