A team is deploying an AI agent in a cloud environment. They need to give the agent access to an S3 bucket. Which credential management approach is MOST secure?

• A.A. Hard-code the AWS access key and secret in the agent's Docker image environment variables
• B.D. Share the company's root AWS account credentials for maximum access
• C.C. Store the AWS access key in an environment variable in the container
• D.B. Use an IAM role attached to the compute resource (EC2 instance profile, ECS task role, Lambda execution role) with a least-privilege policy scoped to the specific S3 bucket and required operations only - no long-lived credentials