Enable sharing through the CloudWatch console by providing the product manager's email and a shareable dashboard link.

Assign an IAM user for the product manager with the CloudWatchReadOnlyAccess policy, sharing credentials and the dashboard URL.

Create an IAM user with the ViewOnlyAccess policy for employees, sharing credentials and instructing the product manager to find the dashboard in CloudWatch.

Use a bastion server in a public subnet, sharing RDP credentials as needed, and configure the browser for dashboard access with cached AWS credentials.