A municipal open-data portal application must write objects to an S3 bucket without embedding long-lived access keys in the app. Which approach should the architect design?
Select an answer to reveal the explanation.
Short Explanation
Hardcoded keys are like leaving the parks shed key taped to the door. Give the app a role that hands out short-lived STS credentials when it runs—on an instance, a task, or via assume-role. When the session ends, the key vanishes; nothing sticky lives in the app.
Full Explanation
Applications should obtain temporary security credentials through IAM roles and AWS Security Token Service (STS)—for example EC2 instance profiles, ECS task roles, Lambda execution roles, or AssumeRole—rather than embedding long-lived IAM user access keys. Hardcoding keys in config, using root credentials, or fetching static keys from S3 still leaves durable secrets in the application path and increases compromise risk.