A developer has written an application that runs on Amazon EC2 instances. The developer is adding functionality for the application to write objects to an Amazon S3 bucket. Which policy must the…

An EC2 instance profile associates an IAM role with the instance, and the AWS SDK automatically retrieves temporary credentials from the instance metadata service. Granting the s3:PutObject (and optionally s3:PutObjectAcl) permission in the identity-based policy attached to that role is the standard and correct mechanism for allowing EC2 instances to write objects to S3.

Session policies are inline policies passed during role assumption using AWS STS; they can only restrict permissions already granted by the role's identity-based policy, not grant new ones.

A KMS key policy controls who can use or manage a specific encryption key; it does not grant S3 bucket access or the ability to write objects.

A VPC endpoint policy controls which principals and actions are permitted through the VPC endpoint; it supplements but does not replace the IAM permissions required on the instance role.