A company needs to grant an external auditor read-only access to specific AWS resources. The auditor has their own AWS account. What is the MOST secure way to grant this access?

Create an IAM user with read-only permissions and share the credentials with the auditor.

Create an IAM role with read-only permissions in the company's account and grant the auditor's AWS account permission to assume the role.

Create an S3 bucket policy that grants public read access to the required resources.

Set up AWS Directory Service and create a user for the auditor.