A company deploys a suite of applications with several AWS CloudFormation stacks. Some team members encounter permission errors when deploying stacks, while others succeed. All team members assume a role that grants the permissions required for their job functions, and all have permissions to operate on the stacks. Which combination of steps will most securely ensure consistent stack deployments? (Choose three.)

The problem describes inconsistent CloudFormation deployments due to permission errors, despite team members having general permissions. This indicates that the CloudFormation service itself might lack the necessary permissions to create or modify resources on behalf of the users. The correct solution involves creating a dedicated CloudFormation service role (cloudformation.amazonaws.com as the service principal) that CloudFormation can assume to perform actions. This role should have granular permissions defined in separate policies, specifying the ARNs of the resources CloudFormation needs to manage. Finally, team members' roles need iam:PassRole permission to allow them to pass this service role to CloudFormation when deploying stacks. This ensures consistent permissions for all stack operations, regardless of the individual user's permissions, and adheres to the principle of least privilege by granting specific resource-level access. Incorrect options: Creating a service role with a composite principal including "every AWS service" is overly permissive and not specific to CloudFormation. Attaching policies that specify only the CloudFormation stack ARNs is insufficient; the service role needs permissions to manage the resources within the stack (e.g., EC2 instances, S3 buckets), not just the stack itself.