AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

The secure way to delegate access across AWS accounts is to create an IAM role in the owning account and configure a trust policy that allows a principal in the other account to assume that role. The role grants only the permissions required-in this case, ssm:GetParameter on the specific parameter. The EC2 instance in the Dev account is associated with an instance-profile role that has permission to call sts:AssumeRole on the target role's ARN. The temporary credentials returned by STS let the application read the parameter without storing long-lived keys. Creating users or sharing access keys violates best practices, and adding permissions to the Dev role alone will not satisfy the cross-account trust requirement because the Parameter Store resource lives in a different account.