A company is migrating a website to a containerized microservices architecture on AWS and has deployed the app to an Amazon ECS cluster. The security policy requires least-privilege network and IAM configurations. After deployment, which steps are required to meet these requirements? (Choose two.)

The awsvpc network mode assigns each task its own elastic network interface (ENI), allowing security groups to be directly applied to individual tasks. This provides granular network control at the task level, aligning with least privilege. The bridge network mode shares the host EC2 instance's network interface, making it impossible to apply security groups directly to individual tasks, thus violating least privilege. Assigning IAM roles directly to tasks (Task IAM Roles) allows containers within a task to assume specific permissions for accessing AWS resources. This is the recommended and most secure approach for granting least-privilege access. Attaching security groups to EC2 instances and using IAM instance profiles grants permissions at the instance level, which is too broad for individual tasks and violates least privilege. Passing IAM credentials into containers at launch time is insecure and not a best practice.