A security team wants to reduce permissions on a role based on its observed CloudTrail activity. Which IAM capability assists with an initial policy draft that still requires review?

1. IAM password policy complexity settings.
2. A security group inbound rule generator.
3. Automatic removal of every permission not used in the last hour without review.
4. IAM Access Analyzer policy generation.