Pick the right credential strategy

You are deploying a Lambda function that needs to read messages from an Amazon SQS queue and write items to a DynamoDB table. A teammate suggests creating an IAM user, generating long-lived access keys, and storing those keys in the function's environment variables so it can authenticate to AWS. You want the most secure approach that follows AWS best practices.

How should the Lambda function obtain its AWS credentials?