An application needs versioned database passwords with controlled access, rather than keeping plaintext credentials in source code. Which approach best fits?

1. Use customer-managed encryption keys through Cloud KMS.
2. Use Artifact Registry repositories with appropriate IAM roles.
3. Deploy an image referenced by its digest.
4. Store credentials in Secret Manager and grant runtime read access narrowly.