An application running on an EC2 instance needs to call APIs to access objects in an S3 bucket. Which combination of steps provides the most secure configuration? (Choose two.)

Creating an IAM role with the necessary S3 permissions is the most secure approach because it avoids embedding static credentials directly on the instance. An instance profile then allows you to attach this IAM role to the EC2 instance, enabling the application to assume the role and obtain temporary credentials automatically. This eliminates the need to manage long-lived access keys, significantly reducing the risk of credential compromise. Incorrect options: Creating an IAM user and adding it to a group, or storing user credentials as environment variables, involves managing static credentials, which is less secure than using roles. Assigning an IAM role to an IAM group is not a valid AWS configuration; roles are assumed by entities, not assigned to groups.