A Lambda function in a shared account must call ec2:DescribeInstances in multiple development accounts. To follow least privilege, how should the permissions be configured across accounts?

The correct approach involves creating an IAM role in each development account with the necessary ec2:DescribeInstances permission. This role's trust policy should allow the shared account (specifically, the Lambda's execution role) to assume it. Concurrently, the Lambda's execution role in the shared account needs an iam:AssumeRole permission to assume these cross-account roles. This adheres to least privilege by granting the ec2:DescribeInstances permission only within the target development accounts, and the Lambda only has permission to assume roles, not directly perform the EC2 action. Incorrect options: Creating a role in the shared account with ec2:DescribeInstances and trusting development accounts would mean the shared account role has direct EC2 permissions, which isn't ideal for cross-account access and doesn't align with least privilege for the development accounts. Granting iam:AssumeRole to the Lambda's role in the shared account without defining specific roles to assume in the development accounts is incomplete. Adding ec2:DescribeInstances to the Lambda's execution role in the shared account directly gives the shared account Lambda permission to describe instances across all accounts it can assume roles into, which is overly permissive.