A Vault deployment serves applications running on AWS. The team wants applications to use established workload identities instead of distributing static Vault credentials. Which method is a suitable candidate?

1. A single shared userpass account for all applications
2. The transit secrets engine as the authentication method
3. The token authentication method with a permanent root token
4. The AWS authentication method with appropriately constrained roles