In a multi-account AWS Organizations environment, a solutions architect must allow an IAM user in Account A to assume a role in Account B. The environment already uses SCPs, resource-based policies, identity-based policies, trust policies, and session policies. Which combination of steps is required? (Choose three.)

To allow an IAM user in Account A to assume a role in Account B, three policy types must be correctly configured. First, the Service Control Policy (SCP) attached to Account A (or its Organizational Unit) must not explicitly deny the sts:AssumeRole action, as SCPs override other permissions. Second, the IAM user in Account A needs an identity-based policy that explicitly grants sts:AssumeRole permission on the ARN of the target role in Account B. This policy defines what the user is allowed to do. Third, the trust policy of the target role in Account B must be updated to trust the IAM user (or the principal, which could be the account ID) from Account A to assume it. This defines who is allowed to assume the role. Incorrect options: Modifying resource-based policies is not the primary mechanism for cross-account role assumption; trust policies on the role handle this. Adding an identity-based policy in Account B for the IAM user is incorrect; identity-based policies are attached to the principal in the same account. Configuring a session policy is optional and typically used for fine-grained permissions after a role is assumed, not for the assumption itself.