A company manages 40 AWS accounts and authenticates employees through an existing SAML 2.0 identity provider. Engineers need centrally managed, temporary access to different AWS accounts according to their team membership. Which solution has the least ongoing administration?

1. Share each account's root-user credentials with the relevant team through a password vault.
2. Create an IAM user for every employee in all 40 accounts and synchronize passwords nightly.
3. Create a Cognito user pool and use its tokens directly to sign arbitrary AWS account-management API requests.
4. Connect the identity provider to IAM Identity Center and assign groups to account permission sets.