A policy requires the organization to control encryption-key lifecycle for a supported cloud data service. Which approach best fits?

1. Use customer-managed encryption keys through Cloud KMS.
2. Use Artifact Registry repositories with appropriate IAM roles.
3. Store credentials in Secret Manager and grant runtime read access narrowly.
4. Deploy an image referenced by its digest.