The company has migrated development and production workloads into a new AWS Organization and created separate member accounts for dev and prod. Consolidated billing is linked to the management account. The solutions architect must create an IAM user in the management account that can stop or terminate resources in both member accounts. Which approach fulfills this requirement?

This approach is correct because it leverages the secure and scalable cross-account role assumption mechanism. An IAM user in the management account can assume roles defined in the member accounts (dev and prod). Each role in the member accounts would be configured with the specific, least-privilege permissions required to stop or terminate resources within that respective account. The trust policy of each role in the member accounts would explicitly allow the IAM user from the management account to assume it. The first option is incorrect because cross-account roles are defined in the target accounts (member accounts), not the source account (management account) where the user resides. The second option is incorrect as it suggests creating IAM users in member accounts, which isn't necessary when a centralized user in the management account is desired, and the role is created in the management account, not the member accounts. The third option is incorrect because an IAM user from one account cannot be directly added to an IAM group in another account.