A deployment role can pass any IAM role to CloudFormation and configure arbitrary resources. The team wants to limit privilege escalation through deployment. Which change is appropriate?

1. Allow passing every role and rely only on the role names sounding safe.
2. Assume CloudFormation templates cannot create an escalation path.
3. Restrict iam:PassRole and deployment permissions to intended roles, services, and resource scope, with appropriate trust and execution policies.
4. Remove all deployment logs while leaving privilege unchanged.