A Lambda function in Account A must read objects from an S3 bucket that resides in Account B. The SysOps administrator will create IAM roles in both accounts to enable this access. Which role configuration will satisfy this requirement?

To enable cross-account access for the Lambda function, a trust relationship must be established. The correct approach involves configuring two roles. In Account A, the Lambda execution role needs permission to assume a role in Account B. This is achieved by adding an sts:AssumeRole permission to the Lambda execution role's policy, targeting the ARN of the role in Account B. Concurrently, in Account B, a separate role must be created with a trust policy that explicitly allows the Lambda execution role from Account A to assume it. This Account B role will then have the necessary S3 read permissions. The Lambda function in Account A will assume the role in Account B to access the S3 bucket. Incorrect options: Directly granting S3 access to the Lambda role in Account A for a bucket in Account B is not possible without a resource-based policy on the S3 bucket itself, which isn't the primary mechanism for cross-account role assumption. Creating the Lambda execution role in Account B is incorrect, as the Lambda function resides in Account A. Having the Account B role assume a role in Account A is a reversed and incorrect flow for this scenario.