A partner AWS account needs read access to CloudTrail logs in your S3 bucket. Which approach follows AWS best practices for cross-account access?
A.Share your account's root credentials with the partner
Root credentials grant unrestricted access to everything and must never be shared.
B.Create an IAM user in your account and share its access key with the partner
Sharing user access keys distributes long-lived credentials that are difficult to rotate safely.
C.Create an IAM role in your account with a trust policy allowing the partner account to assume it, with a policy granting read access to the bucket
Correct. Role assumption with a trust policy is the recommended cross-account pattern.
D.Create a second S3 bucket in the partner account and enable replication
Replication adds cost and complexity and does not give controlled read access to existing logs.
Why this answer
Cross-account access should use IAM roles with trust policies. The partner account assumes the role and receives temporary credentials — no long-lived credentials are shared, and access can be revoked by deleting the role or updating the trust policy.
Correct answer: C · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control