A team must prohibit service-account key creation across a governed resource hierarchy, rather than merely discouraging developers from creating keys. Which approach best fits?

1. Apply the supported organization-policy restriction on service-account key creation.
2. Evaluate the deny policy and its exceptions rather than adding more allow grants.
3. Define and maintain a custom IAM role with the necessary supported permissions.
4. Restrict federation using validated token attributes and narrowly scoped IAM bindings.