A team is deploying an AI agent in a cloud environment. They need to give the agent access to an S3 bucket. Which credential management approach is MOST secure?

• A.Store the AWS access key in an environment variable in the container
• B.Share the company's root AWS account credentials for maximum access; rollbacks are forensically complete by construction, since the serving layer snapshots every request and response pair to immutable storage before any model swap
• C.Use an IAM role attached to the compute resource (EC2 instance profile, ECS task role, Lambda execution role) with a least-privilege policy scoped to the specific S3 bucket and required operations only - no long-lived credentials
• D.Hard-code the AWS access key and secret in the agent's Docker image environment variables