A company will manage many AWS accounts for different departments from a central location. The security team must have read-only access to every account from its own AWS account. The company uses AWS Organizations and has created an account for the security team. What is the correct way for the solutions architect to provide the security team with read-only access to member accounts?

The correct approach is to create a new IAM role in each member account with read-only permissions. This role's trust policy should be configured to allow the security account to assume it. The security team then assumes this role from their account to gain temporary, read-only access to each member account. This method centralizes access control through role assumption, which is a secure and scalable way to manage cross-account access in AWS Organizations. Option 1 is incorrect because you create an IAM role, not an IAM policy, for cross-account access. IAM policies define permissions, while IAM roles are entities that can be assumed. Option 3 and 4 are incorrect because the OrganizationAccountAccessRole is primarily for the management account to access member accounts. While it can be assumed, directly using it for the security team's read-only access across all accounts is not the most secure or granular approach. Creating a dedicated read-only role provides better separation of duties and adheres to the principle of least privilege.