A Lambda function needs access to a small set of highly sensitive objects in an S3 bucket. The company follows least privilege and only allows temporary credentials. What is the MOST secure way to grant the Lambda function access to those S3 objects?

Creating a Lambda execution role with an attached IAM policy is the most secure and recommended approach. This method leverages AWS's built-in identity and access management, providing temporary credentials automatically to the Lambda function without explicit management. The IAM policy can be precisely scoped to grant least privilege, allowing access only to the specific S3 objects required. Hardcoding credentials is a severe security risk as they are exposed in the code. Storing access keys in Secrets Manager or environment variables, while better than hardcoding, still involves managing long-lived credentials and is less secure than relying on temporary credentials provided by an execution role.