You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your…

Assigning the Project Viewer role directly to the DevOps team grants continuous access, violating the "only during the deployment issue" requirement.

While creating a custom IAM role with limited permissions aligns with least privilege, assigning it directly to the DevOps team still grants continuous access, not temporary access for incident response.

Granting the Project Owner IAM role to any service account or user directly violates the least-privilege principle, providing overly broad permissions.

Creating a service account with limited list/view permissions ensures that the *potential* maximum privilege of that service account adheres to the least-privilege principle. By granting the `Service Account User` role to the DevOps team and applying IAM Conditions, you can enable just-in-time (JIT) access, allowing them to impersonate the service account and gain its permissions only for a specific, limited duration (e.g., during an incident). This meets both requirements of least privilege and temporary access.