A development team must make all environment changes only through AWS CloudFormation; direct console or CLI edits are disallowed. Developers use a developer IAM role that currently has the AdministratorAccess managed policy. A CloudFormationDeployment IAM role was created with an attached policy for deployments. The company wants to ensure that only CloudFormation uses the CloudFormationDeployment role and that developers cannot make manual changes to deployed resources. Which combination of steps will enforce this? (Choose three.)

To enforce that only CloudFormation makes changes and developers cannot make manual changes, the developer role's permissions must be restricted. Removing AdministratorAccess and attaching ReadOnlyAccess prevents direct modifications. Developers should then be instructed to specify the CloudFormationDeployment role as the service role for CloudFormation stacks, ensuring CloudFormation performs actions with elevated permissions. The CloudFormationDeployment role's trust policy must allow cloudformation.amazonaws.com to assume it, enabling CloudFormation to use the role. Finally, the CloudFormationDeployment role needs a policy allowing cloudformation: actions and iam:PassRole for itself, specifically when passed to the CloudFormation service, to grant CloudFormation the necessary permissions to manage resources. The incorrect options either grant too much power to developers (allowing them to assume the role directly), or don't properly configure the CloudFormation service role to be assumed by CloudFormation itself.