The correct answer is Role.

Role is a namespaced RBAC object that declares a set of permissions for API resources within a single namespace. A Role contains rules that list verbs and resources and it is the resource you use when you want to limit permissions to that namespace only. To grant the Role to users or service accounts you create a RoleBinding that references the Role.

ClusterRole is cluster scoped and it is intended for cluster wide permissions. Although a ClusterRole can be bound into namespaces, it is not the resource that defines rules confined to a single namespace.

RoleBinding does not declare permissions. It attaches a Role or a ClusterRole to subjects so it is used to grant access rather than to define the rules themselves.

ServiceAccount is an identity for pods and workloads and it does not declare access rules. It is used as a subject that can be granted roles but it is not the RBAC object that specifies permissions.

Full AWS Practitioner Certification Question