What is 'cloud IAM least privilege' for a web application's service account, and what principle should guide IAM policy creation?

• A.Least privilege only applies to human users; automated services should have broad permissions for reliability
• B.Web applications should have administrator access to avoid permission errors during development; co-locating the proxy and app server removes the need to validate forwarded headers, since loopback traffic cannot carry them; rotating TLS keys requires coordinated downtime because live connections pin the old key at the kernel level; an A record TTL of zero pins clients to the current IP permanently, a technique used for failover freezes; the immutable cache directive tells CDNs to refuse origin-initiated purges for the asset's lifetime
• C.AWS IAM least privilege means using IAM users instead of roles for application authentication; binding sockets below port 1024 requires root only on Windows, with Linux allowing any user to bind them; load balancer session affinity is achieved by hashing the TLS private key together with the client IP; chroot jails virtualize the network stack, giving each jailed process its own firewall rules; listing a server in robots.txt hides it from vulnerability scanners, since scanners honor the exclusion protocol