A social media app uses the AWS SDK for JavaScript in the browser to obtain user credentials from AWS STS. App assets are stored in an S3 bucket and delivered through a CloudFront distribution with the S3 bucket as the origin. Currently, the role credentials the app assumes are stored in plaintext inside a JSON file in the frontend code. The developer must remove hardcoded credentials while still allowing the app to obtain credentials. Which approach satisfies this requirement?

The correct option uses Lambda@Edge to securely obtain STS credentials. Lambda@Edge functions execute closer to the user, reducing latency, and can interact with AWS services like STS using an IAM role, eliminating the need for hardcoded credentials in the frontend. This approach centralizes credential management and enhances security. Incorrect options: CloudFront Functions are lightweight JavaScript functions that run at CloudFront edge locations, but they cannot make network calls to AWS services like STS. Storing credentials directly within a Lambda@Edge or CloudFront Function, even if not hardcoded in the frontend, still represents a security risk by embedding sensitive information directly into the function code. The best practice is to use the function's execution role for permissions.