A company will display application metrics on an Amazon CloudWatch dashboard. The product manager needs periodic access but does not have an AWS account. Following the principle of least privilege, how should a solutions architect provide access?

Sharing the CloudWatch dashboard directly via email is the most secure and least privileged method. This feature allows external users to view dashboards without needing an AWS account or direct AWS console access. The product manager receives a unique, time-limited URL to view the dashboard, adhering to the principle of least privilege by granting only view access to the specific dashboard. Creating an IAM user for the product manager or for company employees (options 2 and 3) violates the principle of least privilege because the product manager does not need an AWS account. It also introduces unnecessary management overhead and potential security risks by sharing AWS credentials. Deploying a bastion server (option 4) is overly complex and introduces significant operational overhead and security vulnerabilities for simply viewing a dashboard.