Which solution will meet these requirements?

Explanations:

This option allows the developer IAM role to provision the required resources, but it doesn’t follow the principle of least privilege. The developers would have direct permissions to provision resources, which might be more than necessary. The required permissions should be granted through the use of a CloudFormation service role to limit direct access.

This option gives the developer IAM role full access to AWS CloudFormation. This does not follow the principle of least privilege, as it provides broader access than necessary to CloudFormation. Developers should only have permission to deploy stacks via a controlled service role, not full administrative access to CloudFormation.

While this option suggests using an AWS CloudFormation service role, it grants a broad permission (cloudformation:*), which is not the least privileged option. It provides more permissions than necessary, as only specific actions for stack deployment should be allowed.

This option follows the principle of least privilege by creating an AWS CloudFormation service role with the necessary permissions, and granting the developer IAM role theiam:PassRolepermission. This allows developers to pass the service role when deploying stacks without giving them direct access to provision resources, ensuring proper access control.