An application deployed to an EC2 instance during CodeDeploy’s BeforeInstall lifecycle event needs to install a Python package stored in a CodeArtifact repository. How should you grant the EC2 instance access to CodeArtifact for the install step?

The correct approach is to use an instance profile with an IAM role. An instance profile allows you to assign an IAM role to an EC2 instance, granting it temporary credentials to access AWS services like CodeArtifact. The aws codeartifact login command then uses these credentials to configure the package manager (e.g., pip) to authenticate with CodeArtifact. Incorrect options: Service-linked roles are predefined by AWS for specific services to integrate with other AWS services; they cannot be directly attached to an EC2 instance for this purpose. Resource-based policies grant permissions to principals (users, roles, or AWS accounts) to access a resource, but they don't provide the necessary authentication mechanism for the EC2 instance itself to retrieve packages. CodeArtifact does not use ACLs (Access Control Lists) for repository permissions; it uses IAM policies.