A TypeScript citizen-portal backend must list objects in a departmental S3 bucket using credentials from the runtime role—not hard-coded keys in source. How should it call AWS?
Select an answer to reveal the explanation.
Short Explanation
Never carve AWS keys into the source tree like a spare house key under the mat. Use the SDK and let the runtime role hand out temporary credentials. That is how a citizen-portal backend should talk to S3.
Full Explanation
Official AWS SDKs resolve credentials through the default provider chain, which on Lambda, ECS, or EC2 uses the execution/instance/task role's temporary credentials. Long-term keys in source or shared CSVs are a security anti-pattern. Anonymous public bucket access is not an acceptable substitute for authenticated departmental access. DVA-C02 emphasizes SDK/API usage with IAM roles for programmatic access.