A company will deploy a workload to several hundred EC2 instances launched from a launch template in an Auto Scaling group. The workload reads from one S3 bucket, processes data, and writes results to another S3 bucket. The instances must have least-privilege permissions and must use temporary credentials. What steps are required? (Choose two.)

To provide EC2 instances with temporary, least-privilege access to AWS services like S3, you must use IAM roles. An IAM role defines the permissions, and an instance profile acts as a container for that role, allowing it to be attached to an EC2 instance. Therefore, creating an IAM role with the necessary S3 permissions and associating it with an instance profile is the correct first step. Next, the Auto Scaling group's launch template needs to be updated to specify this instance profile. When new instances are launched by the Auto Scaling group, they will inherit the permissions defined in the associated IAM role through the instance profile. Creating an IAM user and embedding credentials in user data is insecure and violates the principle of least privilege and temporary credentials. Trust anchors and profiles are related to AWS Identity Center (SSO) or AWS Private CA, not directly to assigning roles to EC2 instances.