A resource policy uses a broad service principal to accept AWS-service requests. The team wants to reduce cross-service confused deputy exposure. Which conditions should it evaluate where supported?

1. aws:SourceArn and aws:SourceAccount scoped to the intended source resource and account.
2. A longer resource description that lists the intended source account.
3. An allow for every principal with no resource conditions.
4. A client-supplied HTTP header containing the account name.