A reporting application only needs to read objects from one S3 bucket. What is the most appropriate starting point for its permissions?

1. Allow all users on the internet to read and modify the bucket.
2. Use the AWS account root credentials for all application requests.
3. Allow only the required read operations on the intended bucket resources.
4. Grant administrator access so future permission requests are unnecessary.