When deploying a web application to the cloud (e.g., AWS), which principle should guide IAM permissions assigned to the application's role?

• A.Least privilege - the application's IAM role should have only the specific permissions it needs (e.g., read from a specific S3 bucket, write to a specific DynamoDB table)
• B.Defense in depth - the application's IAM role should have broad permissions in all regions (e.g., S3, DynamoDB, SQS), with network controls added around it
• C.Separation of duties - the application's IAM role should be shared by all services in the account (e.g., one role for S3, DynamoDB, SQS), a setup that simplifies audits
• D.Fail-safe defaults - the role should start with administrator access, then lose permissions after review (e.g., after the first release), never before launch