You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?

A. Create a user-managed service account with a custom Identity and Access Management (IAM) role. B. Create a user-managed service account with the Storage Admin Identity and Access Management (IAM) role. C. Create a user-managed service account with the Project Editor Identity and Access Management (IAM) role. D. Use the default service account linked to the Cloud Run revision in production.