Code for a Lambda function is stored in an S3 bucket and must be deployed across multiple AWS accounts in the same Region. A CloudFormation template will run in each account to deploy the function. What is the MOST secure way to let CloudFormation retrieve the Lambda code from the S3 bucket?

The CloudFormation service role needs s3:ListBucket and s3:GetObject permissions to retrieve the Lambda code from the S3 bucket. To securely allow cross-account access, an S3 bucket policy should be used, explicitly listing the AWS account numbers as principals. This grants access only to the specified accounts, adhering to the principle of least privilege. Incorrect options: Allowing access from principal "" in the S3 bucket policy is insecure as it grants public access to the bucket. Service-linked permissions are for AWS services to assume roles on your behalf, not for CloudFormation to access S3 directly for deployment artifacts. Also, these permissions would be for the Lambda function itself, not for CloudFormation to deploy the function.