Sensitive managed-service data should be protected against access paths outside an approved perimeter, in addition to valid IAM permissions. Which approach best fits?

1. Use Identity-Aware Proxy with suitable backend access restrictions.
2. Apply appropriate Cloud Armor WAF and rate-limiting policies.
3. Configure appropriate firewall rules or firewall policies.
4. Use VPC Service Controls for supported services with appropriate ingress and egress rules.