An automation role should inspect ODB resources but not create or delete them. Which control is appropriate?

1. Disable CloudTrail so read operations cannot become writes.
2. Make the role an AWS root user temporarily for each read.
3. Grant only the required read actions and review effective IAM policy evaluation.
4. Grant all actions because an Oracle database password limits AWS APIs.