An artifact repository needs control over who may upload or download application container images. Which approach best fits?

1. Use Artifact Registry repositories with appropriate IAM roles.
2. Deploy an image referenced by its digest.
3. Store credentials in Secret Manager and grant runtime read access narrowly.
4. Use customer-managed encryption keys through Cloud KMS.