An application on EC2 previously used IAM user access keys stored in environment variables to call DynamoDB via boto. The developer attached an instance role with the same permissions and then deleted the IAM user. After restarting, the app logs show AccessDeniedException, but the developer can run DynamoDB CLI commands using their personal account on the server. What is the MOST likely cause of the exception?

The application is likely still attempting to use the now-invalid credentials stored in environment variables. When an instance profile is attached, the AWS SDK and CLI automatically prioritize credentials in a specific order, typically checking environment variables before instance metadata. Since the environment variables were not removed, the application is still trying to authenticate with the deleted user's access keys, leading to an AccessDeniedException. The CLI commands work because the developer is using their personal account's credentials, which are separate from the application's configuration. IAM policy propagation is usually fast, especially for deletions. The AWS SDK fully supports instance roles. Security group blocking access to the metadata service would prevent the instance profile from working at all, but the problem is specific to the application's authentication method.