A service needs a confidential key file readable only by its own service account. What is the appropriate arrangement?

1. Add the key to a shared shell history
2. Put the key in a publicly accessible web directory
3. Assign the service account ownership with restrictive file permissions
4. Store the key in a world-readable temporary directory