Account A runs a production app on an EC2 instance that must query a DynamoDB table in Account B. What is the MOST secure way to grant the EC2 instance in Account A access to the table in Account B?

Cross-account access in AWS is securely managed through IAM roles and sts:AssumeRole. By creating a role in Account B (the resource owner) that has permissions to query the DynamoDB table and trusts the EC2 instance's role in Account A, Account A's instance can temporarily assume this role. This grants the instance the necessary permissions without sharing credentials. The first incorrect option describes an impossible configuration; DynamoDB does not directly support resource policies for cross-account access in this manner, and PassRole is for passing a role to a service, not for cross-account resource access. The third option is incorrect because DynamoDB tables do not have resource policies that directly grant cross-account access to IAM roles in other accounts. The fourth option, using static access keys, is insecure and against best practices, as it involves embedding long-lived credentials directly on the instance.