A compute application accesses Object Storage using a human operator's API signing key embedded in its image. Which replacement improves credential management while retaining controlled service access?

1. Make the target bucket public to remove every identity requirement
2. Reuse the root administrator's key instead
3. Store the same human key in the instance display name
4. Use an instance principal with a matching dynamic group and scoped policy