Your application requires access to an S3 bucket but should not store credentials in the code. What is the best way to handle this?

A) Store credentials in environment variables
B) Use IAM roles
C) Encrypt credentials with KMS
D) Use Access Key ID and Secret Access Key