Exam AWS Certified SysOps Administrator - Associate topic 1 question 376 discussion

Now DyanmoDB supports resource based policy and hence C is the correct answer https://aws.amazon.com/blogs/database/simplify-cross-account-access-control-with-amazon-dynamodb-using-resource-based-policies/

This option follows the best practice of using IAM roles and cross-account roles for secure access between AWS accounts. By creating an IAM role in Account B with the necessary permissions to query the DynamoDB table and adding the EC2 instance's IAM role to the trust policy of the newly created role, you establish a secure cross-account access mechanism. The EC2 instance can then assume the role in Account B and access the DynamoDB table securely.

Option B describes the most secure solution for granting the EC2 instance in Account A access to the DynamoDB table in Account B:

Looks like correct answer is B. Here is an example with lambda: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-cross-account-access-to-amazon-dynamodb.html And I couldn't find resource policy on dynamoDB.

Answer is B. According to https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-cross-account-access-to-amazon-dynamodb.html You should create a role in account B that has permission to query the DynamoDB table. For Select trusted entity, choose account A. Then create a policy in account A to access Account B.