To review the VPC configuration of developer AWS accounts securely, the best practice is to use cross-account IAM roles with read-only access.

Create an IAM Policy with Read-Only Access:

Navigate to the IAM console in each developer account.

Create a new policy with read-only access to VPC resources. For example:

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": [

"ec2:DescribeVpcs",

"ec2:DescribeSubnets",

"ec2:DescribeRouteTables",

"ec2:DescribeSecurityGroups",

"ec2:DescribeNetworkAcls"

],

"Resource": "*"

}

]

}

Save the policy.

Create a Cross-Account IAM Role:

In the IAM console, choose "Roles" and then "Create role".

Select "Another AWS account" and enter the AWS account ID of the security administrator's account.

Attach the read-only policy created in step 1 to the role.

Save the role and note the role ARN.

Assume the Role from the Security Administrator's Account:

In the security administrator's account, navigate to the IAM console.

Use the "Switch Role" option to assume the cross-account role created in the developer account using the role ARN.

The security administrator can now access the VPC configuration of the developer accounts with read-only permissions.

Cross-Account Access

Creating and Managing IAM Policies