A web app needs customer registration and sign-in, while another component needs temporary AWS credentials for authorized users. Which distinction is correct?

1. An ID token automatically grants unrestricted AWS administration.
2. A user pool provides user authentication; an identity pool can exchange supported identities for temporary AWS credentials.
3. An identity pool must contain every customer password in plaintext.
4. A user pool password is itself an AWS secret access key.