An application on an EC2 instance needs permission to read from an S3 bucket. The team wants to avoid distributing long-lived AWS access keys. Which approach best meets this requirement?

1. Disable S3 authorization checks for the account.
2. Store the root access key in the instance image.
3. Email a developer's access key to every instance owner.
4. Associate an IAM role with the instance and grant the role the required S3 permissions.