A team must prohibit service-account key creation across a governed resource hierarchy, rather than merely discouraging developers from creating keys. Which approach best fits?

1. Define and maintain a custom IAM role with the necessary supported permissions.
2. Restrict federation using validated token attributes and narrowly scoped IAM bindings.
3. Evaluate the deny policy and its exceptions rather than adding more allow grants.
4. Apply the supported organization-policy restriction on service-account key creation.