A Cross-account IAM Role is used to define access to resources in a single account, but it isn't restricted to users in a single account. For example: The EC2 servers in your staging environment can safely get access to an S3 bucket in production by using a properly defined role to do so.
