A manufacturer runs signing servers in on-premises data centers and in another cloud, needing short-lived AWS credentials to upload telemetry to S3 without storing long-lived keys or opening inbound firewall ports. Rotation and audit are required. Which workload identity design grants hybrid servers secure AWS access?

IAM Roles Anywhere is correct because X.509 certificates issued by a trusted CA (for example AWS Private CA) combined with a trust anchor let non-AWS servers cryptographically prove identity to STS and receive short-lived role credentials for S3 uploads over outbound-only connections, satisfying the no long-lived keys, no inbound ports, rotation via certificate lifecycle, and CloudTrail audit requirements across both on-premises and other-cloud locations. The EC2 instance profile design fails by location binding because profile credentials are delivered only via the EC2 instance metadata service and cannot be attached to external hosts, so even with Direct Connect and CloudTrail it remains an AWS-only pattern unsuitable for hybrid servers. The other-cloud OIDC federation design fails by coverage because it is a sound standard for JWT-based STS assumption from that cloud IdP with no stored keys, yet on-premises servers without a compatible OIDC provider are left without identity, breaking the requirement to serve both environments. The Secrets Manager design fails by credential type because rotation and audit make static IAM users operationally safer for hybrid access, yet the keys remain long-lived secrets at rest, violating the short-lived mandate. Exam caveat is to map identity source to solution: certificates for bare servers use Roles Anywhere, JWTs use OIDC federation, EC2 uses instance profiles. Practical check is to validate trust anchor to role mapping, certificate issuance and revocation, outbound reachability to Roles Anywhere and STS, least-privilege S3 policy, and CloudTrail logging of role sessions.