A service account only needs to inspect Oracle Database@Google Cloud inventory. Which authorization approach is best?

1. Allow anonymous access to the project IAM policy.
2. Grant the least-privilege viewing permissions needed for its inventory operations.
3. Grant every oracledatabase permission because it is a service account.
4. Give it every application's database administrator password.