A consumer application needs self-service registration, password reset, MFA, and sign-in through external social identity providers. Its backend will validate tokens before serving API requests. Which AWS service best supplies the managed user directory and authentication flow?

1. Use IAM Identity Center permission sets as the public application's self-service customer registration and password-recovery directory.
2. Amazon Cognito user pools with the required identity providers and MFA configuration.
3. An IAM user for every customer, with a console password and access key.
4. AWS Organizations with one member account for every customer.