A company has an AWS Organizations structure with separate accounts for each business unit. All AWS CloudTrail logs are centralized in an Amazon S3 bucket in the top-level account, which the IT governance team can access. A security engineer created an IAM role in the top-level account for each business unit account, granting read-only access to the bucket objects with that unit’s log prefix. What must be done in each business unit account to allow an IAM user there to read its CloudTrail logs?

To allow an IAM user in a business unit account to read its CloudTrail logs, the user needs permission to assume the cross-account IAM role created in the top-level account. This is achieved by attaching an IAM policy to the user that explicitly grants sts:AssumeRole permission for the specific role's ARN. This allows the user to temporarily take on the permissions of the role, which has read-only access to the relevant S3 log prefix. Creating an SCP is incorrect because SCPs restrict permissions, they don't grant them. Using the root user is a security best practice violation and unnecessary. Sharing credentials is highly insecure and not how cross-account access is managed in AWS.