A partner organization needs read access to the objects in one S3 bucket that your AWS account owns. The partner's developers work exclusively from their own AWS account, and their security policy forbids them from holding credentials issued by another company.
You must grant the access without distributing any long-lived credentials, and you must be able to revoke it from your own account at any time. What should you do?