The auditors need read access without their own keys. A trust policy is drafted in ~/trust.json; read it, then:
sh
aws iam create-role --role-name auditor --assume-role-policy-document file://trust.json
aws iam attach-role-policy --role-name auditor --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/auditor --role-session-name auditExport the three credentials from the answer, then look around as the role:
sh
aws sts get-caller-identity
aws s3 ls
aws s3 mb s3://audit-scratch-5i64viWhen you are done, unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN to be admin again.