An administrator runs an application on Amazon EC2 instances and needs to allow that application to call an Amazon DynamoDB table. Which approach satisfies this requirement securely and correctly?

Assigning an IAM role to an EC2 instance profile is the most secure and recommended method for granting AWS services access to resources like DynamoDB. This approach leverages temporary credentials, eliminating the need to store long-lived access keys directly on the instance, which is a significant security risk. The IAM role defines the permissions, and the instance profile makes these permissions available to applications running on the EC2 instance. Generating long-lived access keys and placing them on the instance is insecure. EC2 SSH key pairs are for SSH access to the instance, not for granting AWS service permissions. Creating an IAM user and associating it with an instance profile is not the correct mechanism; IAM users are for human users or applications outside of EC2 that need long-term credentials.