A compute application reads one secret from Vault. Which identity design best avoids embedding a user's API key in the image?

1. An instance principal in a narrowly scoped dynamic group with the required secret access policy.
2. A private subnet with no IAM authorization at all.
3. A public secret copied into instance metadata.
4. A shared tenancy administrator key baked into every instance image.