A service account can read secrets but a developer should only be allowed to attach it to a workload, not mint arbitrary credentials as it. Which approach best fits?

1. Use a controlled time-bound privileged-access process.
2. Use an IAM condition that limits the grant to the approved time window.
3. Grant the required service-account attachment permission without broad token-creation privileges.
4. Analyze usage and IAM recommendations, then validate a staged permission reduction.