A company runs an application on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3. The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM). Which solution meets these requirements?

The correct solution leverages IAM Roles for Service Accounts (IRSA), a best practice for fine-grained access control in EKS. By creating separate Kubernetes service accounts for the UI and data services, and then associating each service account with a specific IAM role, you can grant precise permissions. The UI service account can assume an IAM role with DynamoDB access, and the data services account can assume an IAM role with S3 access. This ensures that each set of Pods only has the necessary permissions, adhering to the principle of least privilege. The first incorrect option fails because attaching both policies to the EC2 instance profile grants both sets of Pods access to both services, which violates the requirement for segregated access. The second incorrect option is not a valid AWS mechanism; you cannot directly attach IAM policies to EKS Pods. The fourth incorrect option incorrectly assigns the S3 policy to the UI Pods and the DynamoDB policy to the data services Pods, which is the opposite of the requirement.