A company is designing a multi-tenant SaaS application. They need to ensure that each tenant's data is strictly isolated. They are using Amazon DynamoDB. What is the MOST scalable and secure way to implement tenant isolation?

Create a separate DynamoDB table for each tenant.

Use a single DynamoDB table with a partition key that includes the Tenant ID, and use IAM condition keys (dynamodb:LeadingKeys) to restrict access.

Create a separate AWS account for each tenant.

Encrypt each tenant's data with a different KMS key in a single table.