A cloud configuration permits a workload identity to assume a more privileged role under overly broad trust conditions. What should be analyzed?

1. The effective trust relationship, permissions, and reachable escalation path
2. Only whether the service has a public website
3. Only the cloud console's color scheme
4. Only whether the role name contains admin