An application deployed on an EC2 instance needs to read and write to multiple S3 buckets. The developer wants the EC2 instances to make secure API requests without managing credentials and must follow the principle of least privilege. Which solution meets these requirements?

Attaching an IAM role to the EC2 instance is the most secure and recommended approach for granting permissions to AWS services without embedding credentials. The role provides temporary credentials that are automatically rotated, eliminating the need to manage access keys. Restricting permissions to s3:ListBucket and s3:Object on specific S3 buckets adheres to the principle of least privilege, granting only necessary access. Creating an IAM user with access keys is less secure as it requires credential management and rotation. Attaching AmazonS3FullAccess violates the principle of least privilege by granting excessive permissions. A bucket policy alone is insufficient as it only defines access from the bucket's perspective and doesn't provide the EC2 instance with the necessary identity to make requests.