A developer is asked to integrate Amazon CloudWatch into an on-premises application.
How should the application access CloudWatch, according to AWS security best practices?

A. Configure AWS credentials in the application server with an AWS SDK
B. Implement and proxy API-calls through an EC2 instance
C. Store IAM credentials in the source code to enable access
D. Add the application server SSH-key to AWS