A solutions architect is designing an application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read configuration files. What is the MOST secure way to grant the EC2 instances access to the S3 bucket?

Create an IAM user with S3 read access, generate access keys, and store them in the EC2 instance's environment variables.

Create an IAM role with read access to the S3 bucket and attach it to an EC2 instance profile.

Make the S3 bucket public and restrict access using a bucket policy that only allows the EC2 instance's public IP.

Store IAM user credentials in AWS Secrets Manager and configure the application to retrieve them at startup.