IAM role grants no ReadOnlyAccess to external accounts

# Terraform snippet to prevent cross-account access on a role
resource "aws_iam_role" "<example_resource_name>" {
  name = "<example_resource_name>"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        AWS = "arn:aws:iam::<example_account_id>:root" # Critical: trust only the same account to avoid cross-account access
      }
      Action = "sts:AssumeRole"
    }]
  })
}

# CloudFormation snippet to prevent cross-account access on a role
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<example_account_id>:root  # Critical: restrict trust to this account only to avoid cross-account access
            Action: sts:AssumeRole