A partner county role in another AWS account must read objects under a shared GIS export prefix in the city’s S3 bucket. Which policy placement is the clean cross-account pattern?
Select an answer to reveal the explanation.
Short Explanation
Put the welcome mat on the bucket itself: a resource-based policy naming the partner role and the GIS prefix. That beats mailing city access keys or opening the whole bucket to the internet. Partner IAM users inside your account are the messy hallway.
Full Explanation
Cross-account S3 read access is commonly granted with a resource-based bucket policy that principals in the partner account can use together with their identity-based permissions. Scoping to the export prefix limits exposure. Public buckets and shared long-term keys are insecure. Creating city-account IAM users for external partners is an administration-heavy anti-pattern compared with cross-account roles plus a bucket policy.