An application running on EC2 uses long-lived AWS keys in a config file. It needs temporary credentials without per-instance key rotation. Which change is appropriate?

1. Keep static keys and rename the file every week.
2. Copy the same long-lived key into every replacement AMI.
3. Use the account root key to avoid IAM configuration.
4. Use an instance profile role and the SDK credential provider chain; remove the old keys.