Employees use a corporate identity provider and need centrally managed AWS account access without individual IAM user keys. Which solution is preferred?

1. Create permanent administrator access keys in every employee laptop image.
2. Use a public S3 bucket as the workforce session-token directory.
3. Use IAM Identity Center federation and assigned permission sets.
4. Create one IAM user and share its credentials with all employees.