You are converting an existing, ephemeral nonproduction AWS environment into a CloudFormation template. The environment includes an EC2 instance whose instance profile allows it to assume a role in a parent account. You recreated the role in a CloudFormation stack (using the same role name) and deployed the stack in the child account. Afterwards, the EC2 instance cannot assume the role in the parent account due to insufficient permissions. What should you do to fix the problem?

The correct answer addresses the core issue of cross-account role assumption. When an EC2 instance in a child account needs to assume a role in a parent account, the parent account role's trust policy must explicitly permit the principal (in this case, the EC2 instance's instance profile ARN) from the child account to perform sts:AssumeRole. Even if the role name is the same, recreating the role via CloudFormation likely changed its underlying ARN, invalidating the previous trust policy configuration. Updating the trust policy in the parent account with the correct, current ARN of the EC2 instance's instance profile ensures the necessary permissions are in place. The other options are incorrect because: Modifying the trust policy to allow the root principal of the child account is overly permissive and a security risk. Updating the CloudFormation stack with CAPABILITYIAM or CAPABILITYNAMEDIAM is for allowing CloudFormation to create or update IAM resources within its own stack, not for fixing cross-account trust relationships.