An application runs on a Compute Engine VM and needs Google API access as a workload identity, without embedding credentials in its image. Which approach best fits?

1. Attach a least-privilege service account and use application default credentials.
2. Use Workload Identity Federation with appropriately scoped trust and IAM grants.
3. Grant narrowly scoped service-account impersonation permissions and use short-lived credentials.
4. Use Workload Identity Federation for GKE with per-workload grants.