Following security best practices, how should an Amazon EC2 instance be granted access to upload an object to an Amazon S3 bucket?

Assigning an IAM role to an EC2 instance is the most secure and recommended method. This approach leverages temporary credentials, eliminating the need to embed or store long-lived access keys directly on the instance. The IAM role defines the permissions the instance needs (e.g., S3 upload access), and AWS automatically rotates the temporary credentials, reducing the risk of compromise. Embedding access keys in code or storing them in plaintext files are severe security anti-patterns, as these static credentials can be easily exposed and misused. Modifying the S3 bucket policy to allow any service to upload is overly permissive and creates a significant security vulnerability, granting unauthorized access to the bucket.