An application role may pass only one approved execution role to a particular AWS service. Which permission design is most appropriate?

1. Allow only sts:GetCallerIdentity and assume it permits role passing.
2. Scope iam:PassRole to the execution-role ARN and use the supported passed-to-service condition.
3. Use the role display name in an application comment as the only restriction.
4. Allow iam:PassRole on all roles because passing a role cannot increase privilege.