A web application runs on an Amazon EKS cluster using Fargate behind an internet-facing Application Load Balancer. The application has stability problems and increased response times. You must configure observability in Amazon CloudWatch to troubleshoot, granting only the minimum required permissions. Which steps meet the requirement? (Choose three.)

To collect detailed metrics and logs from applications running on EKS Fargate, the CloudWatch agent is needed. Deploying it as a Kubernetes StatefulSet ensures a stable identity and persistent storage if required, though a DaemonSet or Deployment could also work depending on specific needs. Enabling IAM Roles for Service Accounts (IRSA) with the CloudWatchAgentServerPolicy grants the necessary permissions for the agent to send data to CloudWatch while adhering to the principle of least privilege. The CloudWatchAgentAdminPolicy would grant excessive permissions. Configuring an IAM OIDC provider is a prerequisite for IRSA, but not a direct step for observability configuration. Enabling EKS control plane logging provides crucial insights into the cluster's health and operations, which is essential for troubleshooting stability issues. The AWS Distro for OpenTelemetry (ADOT) Collector is an alternative for collecting telemetry but isn't the direct CloudWatch agent.