Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 870 discussion

answer should be D

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

Weird question, but D is actually the only one that allow you to select which developer got access and when, so will go for D

you can't assign groups as principals, b and c don't specify only the senior devs, a is the only one that works here

If you want ALL the developers to assume the role in the production, then C using a trust policy to assume the role in production is perfect BUT You could allow users in development account to assume the role in production, but in the end you will maintain potentially a big trust policy depending of the total number of users. Here you want only some developers to connect to the production (others will follow without knowing if they all can connect and without knowing the number) so managing a separate group will give you a little more maintenance but will allow you to have different rights between the users. I'd say D

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

i think D is better