A resource-based policy, specifically an S3 bucket policy, is the correct method to directly grant permissions on the S3 bucket to entities in another AWS account without sharing any user credentials. This policy allows the external account to assume the necessary permissions. While a service control policy (SCP) applies to all IAM entities in an AWS Organizations account and does not grant permissions to outside accounts, and IAM user policies are attached directly to users within your account, not to resources.