What is 'cloud IAM least privilege' for a web application's service account, and what principle should guide IAM policy creation?

• A.Web applications should have administrator access to avoid permission errors during development
• B.AWS IAM least privilege means using IAM users instead of roles for application authentication
• C.Least privilege only applies to human users; automated services should have broad permissions for reliability
• D.The application's IAM role/service account should only have permissions required for its specific functions: read from specific S3 bucket (s3:GetObject on arn:aws:s3:::my-bucket/*), write to specific DynamoDB table, read from specific Parameter Store paths. No wildcard Actions (s3:*) or Resources (*). In case of compromise, the blast radius is limited to exactly the resources the app can access, rather than the entire AWS account