An EC2 application uses permanent IAM user keys in a configuration file. It only needs to read one DynamoDB table. Which migration is best?

1. Move the same permanent keys into an AMI so fewer people see the file.
2. Use an instance profile role scoped to the table and let the SDK obtain temporary credentials.
3. Allow anonymous DynamoDB access through a public DNS alias.
4. Give the instance the account root access keys.