How would you answer an interview scenario involving AWS IAM in AWS?

Explain how an ECS task should access S3 and Secrets Manager without storing AWS access keys, and how you would scope permissions to only what the service needs.