A SaaS vendor assumes an IAM role in each customer's AWS account to read billing data. A customer wants to prevent another vendor customer from tricking the vendor into assuming this role on the wrong customer's behalf. Which control should the customer add?

1. Enable S3 Transfer Acceleration in the customer's billing-data bucket.
2. Put the role ARN in an environment variable but make no trust-policy change.
3. Replace the role with a shared IAM user whose password is identical for every vendor customer.
4. Require the vendor-assigned, customer-specific external ID in the role's trust policy for AssumeRole requests.