A SageMaker execution role has administrator permissions but only needs one training prefix and one output prefix. What is the best improvement?

1. Move administrator keys into the training script instead.
2. Keep administrator permissions because managed services cannot be misconfigured.
3. Use the job name as the only authorization rule.
4. Scope the execution role to required data, artifact, key, and service operations.