An AWS partner (org1) is building a service that needs API/CLI access to resources in a customer account that belongs to a different AWS Organization (org2). The access must be least privilege and programmatic. What is the MOST secure way for org1 to access org2 resources?

The most secure method involves the customer creating an IAM role with least-privilege permissions and an external ID in its trust policy. The external ID is a security best practice that prevents the confused deputy problem, ensuring that only the intended partner (org1) can assume the role. The partner then assumes this role programmatically using its ARN and the external ID. Giving the partner the customer's AWS account access keys is highly insecure as it grants full administrative access and bypasses all auditing. Creating an IAM user and sharing its credentials is also insecure because it involves long-lived credentials that are difficult to revoke and audit. Creating an IAM role without an external ID is better than sharing credentials, but it still carries a risk of the confused deputy problem if not properly secured.