A design team updates static icons and assets in a development account and then needs to upload the tested assets into an S3 bucket in the company's production account. The design team should be given access to upload to the production bucket without exposing other parts of the production environment. Which combination of steps accomplishes this? (Choose three.)

To allow cross-account access for the design team, a role-based approach is best. First, in the production account, an IAM policy is created that specifically grants read and write access to only the target S3 bucket. This ensures least privilege. Next, an IAM role is created in the production account, and this S3 policy is attached to it. Crucially, the trust policy of this production role is configured to allow the development account to assume it. Finally, in the development account, the design team's IAM users (or a group they belong to) are given an IAM policy that permits the sts:AssumeRole action on the specific production role. This allows users in the development account to temporarily assume the production role and gain the S3 permissions without directly granting them access to the production account itself. Incorrect options: Creating an IAM policy in the development account for the production S3 bucket is incorrect because permissions for resources in the production account must be defined within the production account. Creating a role in the development account with a trust policy for the production account is incorrect because the role with permissions to the production S3 bucket needs to reside in the production account. Permitting sts:AssumeRole on a role in the development account is incorrect because the target role with S3 access is in the production account.