A compute-hosted application needs read access to one application's objects. Which authorization design best follows least privilege?

1. Public read access to every bucket.
2. No IAM policy because the instance has a private address.
3. An instance principal with a suitable dynamic group and narrowly scoped Object Storage policy.
4. A tenancy administrator key in the application configuration.