A document-processing service runs on EC2 instances in an Auto Scaling group. It must read objects only from the incoming/ prefix of one S3 bucket. The security team prohibits storing long-lived AWS credentials on instances. Which solution meets these requirements with the least credential-management overhead?

1. Attach an instance profile with an IAM role that allows s3:GetObject only for the bucket's incoming/* objects.
2. Allow anonymous GetObject requests for incoming/* and rely on unpredictable object names.
3. Attach an IAM role with AmazonS3FullAccess and restrict the prefix in application code.
4. Store an IAM user's access keys in an encrypted AMI and rotate the AMI every month.