Question

A developer is building an application that runs on an on-premises server (not in AWS) and needs to call the Amazon S3 API. The security team prohibits storing long-lived IAM access keys anywhere on the server. Which approach provides temporary AWS credentials to the application while meeting this requirement?

Accepted Answer

Use IAM Roles Anywhere with an X.509 certificate from a trusted certificate authority to obtain temporary credentials via AWS STS.

Answer

Create an IAM user with programmatic access and store the access key ID and secret in a local encrypted file that the application reads at startup.

Answer

Attach an IAM role to the on-premises server the same way you would attach an instance profile to an EC2 instance.

Answer

Embed an IAM access key in the application code and rotate it manually every 90 days using Secrets Manager.