The IoT division at Data Insights Corp collects IoT device data in an S3 data lake, which the analytics team at the separate division, Quantum Analytics, accesses from their EC2 instances in a different AWS account, and both teams must ensure that only authorized networks can access the IoT data according to Data Insights Corp policies. Given the EC2 instances already have S3 access permissions, which combination of steps should a solutions architect take to meet these requirements? (Choose two.)