AWSAccount123-usersAWSAccount456-webappIAMUserIAMPolicyEffect:AllowAction:sts:AssumeRoleResource:arn:aws:iam::456:role/AccountManagerislinkedtoIAMRole "AccountManager"allowstoassumeIAMPolicyEffect:AllowAction:*Resource:*islinkedtoTrustedentities:Account123LambdaS3EC2...allowsaccesstoAWSAccount789-analyticsIAMRole "LambdaManager"IAMPolicyEffect:AllowAction:*Resource:arn:aws:lambda:*islinkedtoTrustedentities:Account123allowstoassumeLambdaS3EC2...allowsaccesstoIAMPolicyEffect:AllowAction:sts:AssumeRoleResource:arn:aws:iam::789:role/LambdaManager