The correct choice is AWS Security Token Service (AWS STS) because it issues short lived, limited privilege credentials that expire automatically and it is designed for scenarios where auditors or external users need programmatic access for 30 minutes to a few hours without long term keys.

AWS STS mints temporary credentials that are tied to IAM roles and policies so permissions can be narrowly scoped and they can be used across accounts by using assume role and cross account access. These temporary credentials remove the need to share long term secrets and they integrate with federated identity flows when auditors authenticate through an identity provider.

AWS IAM Identity Center centralizes workforce sign in and permission sets but it does not itself produce the short lived API credentials that auditors request and it typically relies on role assumption under the hood.

Amazon Cognito targets application and mobile user authentication and it can broker credentials for app users, but it is not the primary service used to issue temporary IAM credentials for external auditors across accounts.

AWS Key Management Service (AWS KMS) manages encryption keys and cryptographic operations and it does not issue temporary security credentials so it is not relevant for granting short term programmatic access.

Full AWS Practitioner Certification Question