Account A owns an S3 bucket with data files that must be accessed by a business partner’s IAM user (User_DataProcessor) in Account B. What steps must the companies take so User_DataProcessor can access the S3 objects from Account B? (Choose two.)

To allow an IAM user from a different account to access an S3 bucket, two main steps are required. First, the resource owner (Account A) must grant permission. This is done by adding a bucket policy to the S3 bucket in Account A. This policy explicitly allows the specific IAM user from Account B (identified by their ARN, e.g., arn:aws:iam::AccountB:user/UserDataProcessor) to perform s3:GetObject and any other necessary actions on the bucket. This is one of the correct answers. Second, the IAM user in Account B must also have an IAM policy attached to them that explicitly allows the s3:GetObject action on the specified S3 bucket in Account A. Both policies must be in place for the access to be granted. CORS is for browser-based access and not directly relevant for programmatic access by an IAM user. Denying actions in Account B is not the primary mechanism for granting cross-account access; an explicit allow is needed.