A third-party SaaS provider assumes a customer AWS role on behalf of many customers. The customer wants to mitigate the confused-deputy risk. Which control is appropriate?

1. Grant AdministratorAccess to the SaaS role to avoid the need for trust conditions.
2. Treat the role display name as a secret authorization token.
3. Use the same public external ID for every customer and trust every AWS principal.
4. Require the provider-assigned unique ExternalId in the role trust condition and restrict the trusted principal.