An enterprise uses its corporate identity provider for workforce access. Administrators need different permissions in 40 accounts and should not manage IAM user keys. Which design is preferred?

1. Use only VPC security groups to decide which console actions employees can perform.
2. Create one permanent administrator key copied to every workstation.
3. Share the management-account root credentials with all administrators.
4. Use IAM Identity Center federation with group assignments and account-specific permission sets.