A developer is creating an application that reads and writes to multiple Amazon S3 buckets. The application will be deployed to an Amazon EC2 instance. The developer wants to make secure API…

Creating an IAM user with access keys and secret keys requires embedding or managing long-lived credentials in the application or environment, which increases security risk and contradicts the requirement to avoid managing credentials.

Attaching an IAM role with an IAM policy granting only `s3:ListBucket` and `s3:*Object` to the EC2 instance provides the minimum permissions needed for read/write operations on S3 buckets. The instance automatically obtains temporary credentials via the instance metadata service, eliminating the need to manage long-lived access keys.

The `AmazonS3FullAccess` managed policy grants all S3 actions including bucket deletion, policy changes, and replication configuration, which violates the principle of least privilege for an application that only needs read and write access.

A bucket policy can restrict which principals access a bucket, but it cannot grant the EC2 instance the ability to authenticate to AWS without credentials; a bucket policy alone does not provide a mechanism for credential-free API calls from EC2.