How should the developer configure the permissions to adhere to the principle of least privilege?

Explanations:

This option suggests creating a role in the shared account with permissions to describe instances in development accounts. However, the Lambda function needs permission to access resources in the development accounts, which requires a trust relationship established from the development accounts.

This option correctly proposes creating an IAM role in the development accounts with the necessary permission (ec2). The role should establish a trust relationship with the shared account, allowing the Lambda function to assume the role, adhering to the principle of least privilege by granting access only to the required action in a limited scope.

This option also suggests creating a role in the shared account, but it does not provide access to the Lambda function in the shared account to the resources in the development accounts. The trust relationship should be established from the development accounts to the shared account for proper access.

While this option correctly suggests creating a role in the development accounts with the necessary permission, it incorrectly states that the Lambda function’s role in the shared account should have ec2permission. Instead, it should assume the role created in the development accounts to gain that permission, thus not adhering to least privilege for the Lambda function’s role.