A DevOps engineer must let developers deploy CloudFormation stacks even though the developer IAM role lacks permissions to create the resources defined in the templates. The solution must follow least privilege. Which approach satisfies this?

The correct approach involves creating an AWS CloudFormation service role with the necessary permissions to provision resources. Developers, using their IAM role, then need the iam:PassRole permission to allow CloudFormation to assume this service role during stack creation or updates. This adheres to the principle of least privilege because the developer role itself doesn't have direct permissions to create resources; it only has permission to "pass" the more privileged service role to CloudFormation. The incorrect options are: Creating an IAM policy that allows developers to provision resources directly violates least privilege, as developers would have broad resource creation permissions. Granting full access to AWS CloudFormation is overly permissive and a significant security risk. Granting cloudformation: to the developer role is too broad and does not address the underlying resource creation permissions needed by CloudFormation, nor does it properly utilize a service role for resource provisioning.