A manufacturer runs Linux servers on-premises that upload telemetry to S3 daily. Security forbids long-lived AWS access keys, requires short-lived credentials tied to server identity, and needs automatic rotation. Which authorization approach best grants application access without stored secrets?
Select an answer to reveal the explanation.
Short Explanation
Those servers deserve badges that expire, not master keys. Roles Anywhere swaps your existing server certificates for short-lived AWS credentials automatically.
Full Explanation
IAM Roles Anywhere establishes a trust anchor from your certificate authority and lets on-premises servers authenticate with X.509 certificates to assume IAM roles for short-lived temporary credentials, eliminating long-lived access keys while enforcing role trust policies and CloudTrail auditing with automatic expiry. Verified Permissions provides fine-grained Cedar-based authorization for custom applications but does not issue AWS credentials or authenticate server identity for S3 API calls. IAM users with paths organize identities for billing or delegation but still rely on long-term access keys, and Lambda rotation reduces but does not remove secret storage and handling risk. EC2 instance profiles deliver temporary credentials only to EC2 via the instance metadata service and cannot be extended to on-premises hosts over VPN. Exam caveat: Roles Anywhere requires robust private CA lifecycle and revocation plus strict role trust conditions on certificate attributes. Practical check: verify credential helper issuance, test S3 upload with temporary credentials, and confirm CloudTrail AssumeRole events.