iam_crossaccount_policy.json

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": [
      "arn:aws:iam::<YOUR_USERS_ACCOUNT_ID_HERE>:role/<YOUR_USERS_ACCOUNT_ROLE_NAME_HERE>"
    ]
  },{
    "Effect": "Allow",
    "Action": "ec2:DescribeTags",
    "Resource": "*"
  }]
}