A company is deploying a new public cloud, multi-tier application and needs to set ACL policies to grant permissions to the cloud provider's services on which the application depends. Each tier in…

Creating distinct "users" (interpreted as service accounts or IAM roles) for different application tiers or components enables the principle of least privilege, where each part of the application receives only the specific permissions required for its function. This approach enhances security and maintainability, as permissions can be scoped precisely to each component's dependencies without over-provisioning access.

Simply creating policies is insufficient; these policies must be attached to an identity (user, role, or group) that the application tier can assume to gain permissions, making this an incomplete solution.

Creating a single, broad policy for the entire application violates the principle of least privilege, granting unnecessary permissions to components that don't require them and thus increasing the security risk.

Similar to option B, creating policies alone is incomplete; they must be associated with specific identities that the application uses to interact with services to be effective.