The correct option is IAM access keys. They provide the access key ID and secret access key pair that scripts use to authenticate and sign programmatic API requests made with the AWS CLI or SDKs.

IAM access keys are the mechanism the CLI and SDKs expect when performing signed API calls. You can associate access keys with an IAM user or you can avoid long lived keys by using roles and temporary credentials for automation which improves security.

AWS Certificate Manager is incorrect because it provisions and manages SSL and TLS certificates to secure network traffic and it does not supply credentials for AWS API calls.

SSH public keys are incorrect because they authenticate SSH sessions to instances or services that accept SSH and they are not used to sign generic AWS service API requests.

Username and password are incorrect because those are used for console sign in and cannot be used by the CLI or SDKs to sign programmatic requests. For programmatic access you must use access keys or temporary credentials issued by roles.

Full AWS Practitioner Certification Question