Create an IAM role and IAM policy for each vendor. Use cross-account resource sharing to share the appropriate IAM role ARN with each vendor. Instruct each vendor to use the IAM role ARN to access the data lake from a resource in the vendor ' s AWS account. Set up S3 server access logging for the S3 bucket.

Create an IAM user for each vendor. Use an IAM policy to grant access to the S3 data lake. Share the user credentials for each IAM user with each vendor. Set up S3 server access logging for the S3 bucket.

Deploy AWS IAM Identity Center. Create a user account for each vendor. Create S3 Access Grants for each vendor that have the required permissions.

Create an S3 presigned URL for each vendor that has the required permissions. Share the appropriate URL with each vendor to access the S3 bucket. Configure AWS CloudTrail logs to collect access logs for the S3 bucket.