A project on Amazon Linux failed a security review. You are reviewing a CodeBuild buildspec.yaml and must recommend security improvements. Which changes follow AWS best practices? (Choose three.)

Storing AWS credentials directly in environment variables is a security risk; granting the CodeBuild project's IAM service role only the necessary permissions adheres to the principle of least privilege and is the recommended practice. Storing sensitive information like DBPASSWORD as a SecureString in AWS Systems Manager Parameter Store is a secure method for managing secrets, preventing their exposure in build logs or configuration files. Using AWS Systems Manager Run Command for interacting with instances is more secure than scp and ssh because it operates without opening inbound ports, provides detailed logging, and integrates with IAM for fine-grained access control. Deleting temporary files is good practice but doesn't prevent access by other CodeBuild users if the container is reused or its image is compromised. Storing environment variables in S3 and then downloading them is less secure than Parameter Store for sensitive data. Obfuscating environment variables is not a secure alternative to proper secrets management and can be easily reversed.