S3 + KMS

SSM + KMS

Instance Profiles + IAM Roles