A deployment script contains a tenancy administrator's private key. What is the best remediation for a script running on OCI compute?

1. Base64-encode the key and leave all privileges unchanged.
2. Disable Audit so the key cannot be observed in records.
3. Use an instance principal and narrowly scoped policies where supported.
4. Copy the key into a public image for consistency.