A build needs packages from a private CodeArtifact repository. What access approach is appropriate for its automated build identity?

1. Use the supported authorization-token workflow and narrowly scoped repository and related permissions.
2. Embed an account root key permanently in the package source URL.
3. Use a repository name as the complete authentication token.
4. Make every private package publicly available to avoid build authentication.