An application needs versioned database passwords with controlled access, rather than keeping plaintext credentials in source code. Which approach best fits?

1. Deploy an image referenced by its digest.
2. Use Artifact Registry repositories with appropriate IAM roles.
3. Use customer-managed encryption keys through Cloud KMS.
4. Store credentials in Secret Manager and grant runtime read access narrowly.