External auditors in a single AWS account need secure, read-only access to the company's AWS account for financial audits. The solution must follow AWS security best practices. Which approach should the solutions architect implement?

Creating an IAM role that trusts the auditors' AWS account is the most secure and recommended approach. The auditors can assume this role from their own AWS account, eliminating the need to create IAM users for them in your account or share credentials. Attaching a read-only IAM policy to the role ensures least privilege. Including a unique external ID in the trust policy prevents the confused deputy problem, adding an extra layer of security by ensuring that only the intended party can assume the role. Adding resource policies to every resource is impractical and difficult to manage at scale. Creating an IAM user and sharing API keys is a significant security risk as it involves sharing long-term credentials. Creating IAM users for each auditor and adding them to a group is less secure than using a cross-account role, as it still requires managing user credentials within your account for external parties.