The company must encrypt all AMIs that are shared across accounts. You have an unencrypted custom AMI in the source account, and an Auto Scaling group in the target account will launch EC2 instances from the AMI. A KMS key exists in the source account. Which additional steps are required? (Choose three.)

To use an encrypted AMI across accounts, you must first encrypt it. Copying the unencrypted AMI to an encrypted one using a customer-managed KMS key in the source account is the correct first step. Sharing an unencrypted AMI would not meet the encryption requirement. Sharing the encrypted AMI with the target account allows the target account to access it. Finally, for the Auto Scaling group in the target account to launch instances from the encrypted AMI, it needs permission to use the source-account KMS key. Updating the source KMS key policy to allow the target account to create grants, and then creating a grant in the target account for the Auto Scaling service-linked role, provides the necessary cross-account KMS key usage permissions. Specifying the default Amazon EBS encryption key would not use the required source-account KMS key. Creating a KMS grant directly in the source account for a target-account role is not the standard cross-account KMS sharing mechanism.