A database specialist wants to grant the read role to DocumentDB user “Bob” on DocumentDB database “production”. What action must the database specialist perform to accomplish this requirement?

Answer options:

A.Assign AWS Managed Policy “AmazonDocDBReadOnlyAccess” to IAM User “Bob”.
B.Create an IAM policy with “Allow” Effect on “read” Action for the “production” DocumentDB instance resource. Assign the IAM policy to IAM User “Bob”.
C.Create a Resource-Based Policy with “Allow” Effect on “read” Action for DocumentDB user “Bob”. Assign the policy to the DocumentDB instance.
D.Run command db.grantRolesToUser("Bob", [{role: "read", db: "production"}]).

Answer: D
Option A is incorrect because IAM Policies control access to DocumentDB API actions and DocumentDB clusters and instances, not databases. The question specifically asks for granting access to a DocumentDB database. Additionally, the question is asking for granting access to a DocumentDB user, not an IAM user.
Option B is incorrect because IAM Policies control access to DocumentDB API actions and DocumentDB clusters and instances, not databases. The question specifically asks for granting access to a DocumentDB database. Additionally, the question is asking for granting access to a DocumentDB user, not an IAM user.
Option C is incorrect because DocumentDB does not support resource-based policies.
Option D is CORRECT because db.grantRolesToUser command is used for assigning DocumentDB database roles to DocumentDB database users.
Reference:
https://docs.aws.amazon.com/documentdb/latest/developerguide/role_based_access_control.html