A central security account must review CloudTrail logs stored in several department AWS accounts without sharing long-term access keys with those departments. What IAM pattern enables that cross-account access?
Select an answer to reveal the explanation.
Short Explanation
Cross-account roles are like a visitor badge that expires — the security team assumes a role in each department account for a short time instead of collecting permanent keys. No sticky notes with passwords, just temporary, auditable access.
Full Explanation
Cross-account IAM roles let a principal in one account assume a role in another account and receive temporary credentials. This avoids sharing long-term access keys across accounts and supports centralized security review patterns. At CLF depth, recognize roles as the preferred cross-account access mechanism.