Question

A company acquires a partner organization that uses a separate cloud provider account. Developers from the partner need occasional read-only access to a set of resources in the company's account. Security policy prohibits creating long-lived credentials or sharing account root access. Which approach best satisfies these requirements?

Accepted Answer

Configure cross-account role assumption with a trust policy, allowing partner identities to assume a scoped read-only role that issues temporary credentials

Answer

Create individual IAM users in the company account for each partner developer and distribute long-lived access keys

Answer

Share the company account's root user credentials with the partner's security team for controlled distribution

Answer

Embed a static API key with read-only permissions into the partner's application configuration files