According to security best practices, how should an Amazon EC2 instance be given access to an Amazon S3 bucket?