An application on an OCI compute instance must access other OCI resources without storing a human user's API key. Which approach is appropriate?

1. Copy the tenancy administrator's API key into the application image
2. Use an instance principal and an IAM policy for the matching dynamic group
3. Disable IAM authorization for the target service
4. Put the administrator's password in the instance display name