The docs hadn't been updated to reflect the ability to do cross-account AWS IAM auth, and so it was a bit confusing as to whether that was supported. This removes the ambiguity by explicitly mentioning AWS IAM principals.
default-service
default-batch