For cross-account access, the standard AWS pattern is to create an IAM role in the resource-owning account (the company’s account) and configure the trust policy to allow the external vendor account to assume that role.
Option D correctly follows this model. The company creates an IAM role with the necessary CloudWatch Logs permissions and configures the trust policy to trust the vendor’s IAM role ARN. The vendor then assumes this role to access logs securely.
The other options misconfigure trust relationships or place permissions in the wrong account, breaking the cross-account access model. Therefore, D is the correct solution.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit