An application running on an Amazon EC2 instance needs to securely upload files to an Amazon S3 bucket. What is the MOST secure way to grant the application the required permissions?

Attaching an IAM role to an EC2 instance is the most secure method because it leverages temporary credentials automatically managed by AWS. The application running on the instance can assume the role and obtain these credentials without needing to store long-lived access keys. Creating an IAM user with access keys and storing them in environment variables is less secure because these are long-lived credentials that could be compromised if the instance is breached. Creating an IAM role and then creating access keys for that role is incorrect; IAM roles do not have permanent access keys. Roles are assumed to obtain temporary credentials. Applying an S3 bucket policy granting access to the EC2 instance ID is not a direct way to grant permissions to an application running on an instance. While bucket policies can restrict access, the instance still needs an identity (like an IAM role) to make authenticated requests.