You currently have an S3 bucket hosted in an AWS Account. It holds information that needs to be accessed by a partner account. Which is the MOST secure way to allow the partner account to access the S3 bucket in your account? Select 3 options.

Answer options:

A.Ensure an IAM role is created which can be assumed by the partner account.
B.Ensure an IAM user is created which can be assumed by the partner account.
C.Ensure the partner uses an external id when making the request.
D.Provide the ARN for the role to the partner account.
E.Provide the Account Id to the partner account.
F.Provide access keys for your account to the partner account.

Answer: A, C, and D
Option A is CORRECT because a cross-account assume role has to be created for the requesting AWS account to access the services in your account.
Option B is incorrect because IAM roles are assumed and not IAM users to allow cross-account service access.
Option C is CORRECT because a cross-account assume role requires an external ID to be provided for the requesting AWS account to access the services in your account.
Option D is CORRECT because a cross-account assume role requires an ARN to be provided for the requesting AWS account to access the services in your account.
Option E is incorrect because the account ID is already available through ARN shared with the cross-account who wants to make a request.
Option F is incorrect because access keys are not required to assume a role for the requesting AWS account.
For more information on cross-account S3 access, refer to the URLs provided below:
https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html