Explanation

AWS Identity and Access Management (IAM) is the correct answer because:

• IAM enables fine-grained access control - It allows you to create policies that grant specific permissions to users, groups, roles, and services
• Principle of least privilege - IAM supports implementing the security best practice of granting only the minimum permissions necessary to perform required tasks
• Application permissions management - IAM roles can be assigned to applications running on AWS services (like EC2 instances, Lambda functions) to control what AWS resources they can access
• Policy-based authorization - IAM policies define what actions are allowed or denied on which AWS resources under what conditions

Why the other options are incorrect:

• Amazon CloudWatch - A monitoring and observability service for collecting and tracking metrics, logs, and events
• Amazon Macie - A security service that uses machine learning to discover and protect sensitive data in AWS
• Amazon GuardDuty - A threat detection service that continuously monitors for malicious activity and unauthorized behavior

IAM is specifically designed for identity and access management, making it the appropriate service for implementing the principle of least privilege for application permissions.