Accounts are organized under AWS Organizations. An application in Account A stores environment variables as parameters in AWS Systems Manager Parameter Store. A new application in Account B needs to use those same parameters from Account A without duplicating them into Account B. Which solution provides access with the LEAST operational overhead?

Creating an assumable IAM role in Account A with permission to read the parameters, and allowing Account B to assume that role, is the most secure and operationally efficient solution. This approach leverages AWS's built-in cross-account access mechanisms, avoiding duplication and centralizing parameter management. Account B's applications can then assume this role to retrieve the parameters without needing separate credentials. Using IAM user credentials in Account A for Account B's application is less secure and harder to manage. AWS Resource Access Manager (RAM) is used for sharing resources like subnets or transit gateways, not Systems Manager parameters. Copying parameters to an S3 bucket introduces unnecessary complexity, potential for data staleness, and additional operational overhead.