Sensitive managed-service data should be protected against access paths outside an approved perimeter, in addition to valid IAM permissions. Which approach best fits?

1. Use Identity-Aware Proxy with suitable backend access restrictions.
2. Use VPC Service Controls for supported services with appropriate ingress and egress rules.
3. Configure appropriate firewall rules or firewall policies.
4. Apply appropriate Cloud Armor WAF and rate-limiting policies.