An application on an EC2 instance needs permissions to send, receive, and delete messages from specific Amazon SQS queues. Which approach provides the required permissions in the most secure way?

Creating and attaching an IAM role for EC2 is the most secure method because it eliminates the need to store credentials directly on the instance or in application code. EC2 instances can automatically assume the role, and temporary credentials are provided, reducing the risk of long-term credential compromise. Granting only sqs:SendMessage, sqs:ReceiveMessage, and sqs:DeleteMessage adheres to the principle of least privilege, ensuring the instance has only the necessary permissions and no more. The other options are less secure. Embedding or exporting IAM user credentials (access keys and secret keys) creates a security risk; if the instance is compromised, these static credentials could be stolen and used indefinitely. Granting sqs: permissions violates the principle of least privilege by providing broader access than required, increasing the potential impact of a security breach.