An application on EC2 reads from one S3 prefix. It currently uses a long-lived IAM user access key in a local configuration file. Operations wants temporary credentials and least-privilege access without manual key rotation on every instance. What should it do?

1. Make the S3 prefix public and remove all authentication from the application.
2. Use the account root access key because it does not need an IAM role.
3. Embed the same access key in the AMI so all replacement instances share it.
4. Attach an IAM role through an instance profile with access to the required prefix, use the SDK credential provider chain, and remove the old keys.