Backup automation needs access to a designated Object Storage bucket. Which IAM approach is appropriate?

1. Scope the required object and bucket permissions to the intended backup resources.
2. Share an administrator API private key in a resource tag.
3. Add every application user to the tenancy Administrators group.
4. Make the bucket public so the database needs no authorization.