A company needs to allow a vendor to access CloudWatch Logs in the company’s AWS...

For cross-account access, the standard AWS pattern is to create an IAM role in the resource-owning account (the company’s account) and configure the trust policy to allow the external vendor account to assume that role.

Option D correctly follows this model. The company creates an IAM role with the necessary CloudWatch Logs permissions and configures the trust policy to trust the vendor’s IAM role ARN. The vendor then assumes this role to access logs securely.

The other options misconfigure trust relationships or place permissions in the wrong account, breaking the cross-account access model. Therefore, D is the correct solution.