An event-stream processing application runs in an Amazon EKS cluster and writes results to Amazon DynamoDB. The containers must access DynamoDB securely without embedding AWS credentials. Which solution satisfies this requirement?

Attaching an IAM role to EKS worker nodes and configuring IAM Roles for Service Accounts (IRSA) is the most secure and recommended solution. IRSA allows you to associate an IAM role directly with a Kubernetes service account, which is then assigned to specific pods. This grants fine-grained permissions to individual pods, ensuring that only the necessary applications can access DynamoDB, without embedding credentials. Storing credentials in S3 or using environment variables/Kubernetes Secrets with IAM user access keys are less secure as they involve managing static credentials, increasing the risk of exposure.