An artifact repository needs control over who may upload or download application container images. Which approach best fits?

1. Store credentials in Secret Manager and grant runtime read access narrowly.
2. Deploy an image referenced by its digest.
3. Use customer-managed encryption keys through Cloud KMS.
4. Use Artifact Registry repositories with appropriate IAM roles.