A User Has Created an Application Which Will Be Hosted

Multiple Choice

A user has created an application which will be hosted on EC2. The application makes API calls to DynamoDB to fetch certain data. The application running on this instance is using the SDK for making these calls to DynamoDB. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?

A) The user should create an IAM user with permissions to access DynamoDB and use its creden-tials within the application for connecting to DynamoDB
B) The user should create an IAM user with DynamoDB and EC2 permissions. Attach the user with the application so that it does not use the root account credentials
C) The user should attach an IAM role to the EC2 instance with necessary permissions for making API calls to DynamoDB.
D) The user should create an IAM role with EC2 permissions to deploy the application