A partner needs temporary access to a particular Object Storage object without receiving a tenancy user's signing key. Which capability may fit when appropriately scoped and protected?

1. An NSG rule alone with no Object Storage authorization mechanism
2. A bucket display name used as a password
3. A publicly posted administrator API key
4. A pre-authenticated request with suitable access and expiry