A security engineer must run an AWS CloudFormation template that provisions infrastructure for a production stack with web servers and a MySQL database. The template has been validated in pre-production. The production execution must follow least privilege and maintain separation of duties between the engineer’s IAM account and CloudFormation. Which approach meets these requirements?

The correct option uses IAM Access Analyzer to generate a least-privilege policy for the CloudFormation service role. This role is then passed to CloudFormation by the engineer using PassRole, ensuring CloudFormation operates with the necessary permissions without granting those permissions directly to the engineer. This maintains separation of duties: the engineer initiates the deployment, but CloudFormation performs the resource creation using its own, specific permissions. Incorrect options: Granting ec2: and rds: is overly permissive and violates least privilege. AssumeRole for the engineer would mean the engineer directly assumes the powerful role, not CloudFormation. Updating the engineer's permissions to run the template directly would grant the engineer all permissions needed by the template, violating least privilege and separation of duties. While ec2: and rds: are still overly permissive, using the IAM policy simulator is good practice for validation but doesn't fix the over-permissioning.