An application on EC2 instances in an Auto Scaling group reads objects from an S3 bucket. The deployment script writes an IAM user's access key ID and secret access key into a configuration file baked into the AMI. A security review demands that no long-lived credentials be stored on the instances, and the application code must not change the way it calls the AWS SDK.