An EKS workload requires AWS API access to one S3 prefix. The team wants to avoid granting the same permissions to every pod through a broad node role. Which design is preferred?

1. Use only a Kubernetes namespace name as AWS authorization.
2. Use a supported pod-scoped identity mechanism with a least-privilege role.
3. Attach S3 administrator access to the worker node role for all pods.
4. Embed permanent administrator keys in the container image.