A retail company has multiple business teams, each managing its own AWS account under AWS Organizations. Each team stores product inventory in a DynamoDB table in its account. A central inventory reporting application runs in a shared account and must read items from all teams' DynamoDB tables. Which authentication option meets these requirements MOST securely?

The most secure option is to use cross-account IAM roles. This approach leverages AWS Security Token Service (STS) AssumeRole to grant temporary, limited-privilege credentials to the reporting application. The APPROLE in the central account assumes the BUROLE in each business account, which has permissions only to its respective DynamoDB table. This avoids sharing long-lived credentials and adheres to the principle of least privilege. Integrating DynamoDB with Secrets Manager is not a direct authentication method for DynamoDB itself; it stores credentials, but the underlying authentication mechanism would still be needed. Creating IAM users with programmatic access in each account is less secure because it involves managing long-lived access keys, which are prone to compromise and require manual rotation. Integrating DynamoDB with ACM is incorrect as ACM manages SSL/TLS certificates for services like Elastic Load Balancing and CloudFront, not for direct authentication to DynamoDB.