The Creative team stores images in an S3 bucket in the Creative account and uses a custom AWS KMS key attached to that bucket. The Strategy account needs read-only access to view objects. A cross-account IAM role named strategy_reviewer exists in the Strategy account. When users assume strategy_reviewer and attempt to read objects, they get Access Denied. You must grant the Strategy account only the minimum required permissions. Which combination of steps should you take? (Choose three.)

To enable cross-account access, both the resource owner (Creative account) and the accessor (Strategy account) must grant permissions. The S3 bucket policy in the Creative account must explicitly allow the Strategy account to read objects. Setting the principal to the Strategy account ID ensures this. Since the objects are encrypted with a custom KMS key, the Strategy account also needs permission to decrypt them. This requires two steps: first, the KMS key policy in the Creative account must allow the strategyreviewer role to perform kms:Decrypt actions. Second, the strategyreviewer IAM role in the Strategy account must have an inline policy allowing s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key. Incorrect options: Updating the strategyreviewer role with "full permissions" is not the minimum required. Setting the S3 bucket policy principal to an anonymous user is insecure and grants access to anyone. Granting kms:Encrypt permissions is unnecessary for read-only access.