Roles vs Users for Access
A partner's auditing tool runs in their own AWS account and needs read-only access to resources in yours. What is the recommended setup?
Choose one answer
Create an IAM role with a trust policy for the partner's account (with an external ID) and a read-only permissions policy; they assume it through STS.
Create an IAM user for the partner and send them its access keys.
Add the partner's existing IAM users to an IAM group in your account.
Add the partner's account ID to your security groups.