Your company has been using AWS for the past 2 years. They have separate S3 buckets for logging the various AWS services that have been used. They have hired an external vendor to analyze their log files. They have their own AWS account. What is the best way to ensure that the partner account can access the log files in the company account for analysis? Choose 2 answers from the options given below.

Answer options:

A.Create an IAM user in the company account that has read-only access to the S3 buckets.
B.Create an IAM role in the company account that has read-only access to the S3 buckets.
C.Provide the IAM user credentials to the external vendor.
D.Ensure the IAM role can be assumed by the external vendor.

Answer – B and D
The AWS Documentation mentions the following.
To share log files between multiple AWS accounts, you must perform the following general steps. These steps are explained in detail later in this section.
· Create an IAM role for each account that you want to share log files with.
· For each of these IAM roles, create an access policy that grants read-only access to the account you want to share the log files with.
· Have an IAM user in each account programmatically assume the appropriate role and retrieve the log files.
Options A and C are invalid because creating an IAM user and then sharing the IAM user credentials with the vendor are direct ‘NO’ practices from a security perspective.
For more information on sharing cloudtrail logs files, please visit the following URL:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-sharing-logs.html