An application on EC2 serves objects stored in an S3 bucket to users. After enabling S3 Block Public Access on the bucket, users can no longer download objects. The requirement is that only users authenticated through the application can access the objects. Which combination of steps will securely meet this requirement? (Choose two.)

The correct approach involves two key steps for secure, authenticated access. First, creating an IAM role with an instance profile and assigning it to the EC2 instances grants the application running on those instances the necessary permissions to access S3 objects without embedding credentials. This adheres to the principle of least privilege and improves security. Second, using S3's GeneratePresignedUrl API allows the application to create temporary, time-limited URLs for specific objects. These URLs can then be provided to authenticated users, enabling them to download objects directly from S3 without the bucket being publicly accessible. Storing IAM user access keys directly on EC2 instances is insecure and against best practices. Returning an object handle or delegating direct requests to S3 would not work if the bucket is private and users are not directly authenticated with S3.