The Access Key ID and Secret Access Key are long term credentials that belong to an identity and are issued to an IAM user or the AWS account root user for signing programmatic requests to the AWS CLI and SDKs.

These keys are long lived and are attached directly to the principal that owns them so an IAM user receives static access keys that persist until rotated or deleted and this makes them suitable for CLI and SDK use when ongoing programmatic access is required.

IAM role is incorrect because roles are assumed and provide temporary credentials from AWS STS and you do not create static access keys for a role.

IAM policy is incorrect because a policy is a JSON permissions document and does not contain or hold credentials.

IAM user group is incorrect because groups only aggregate users for permissions and you cannot attach long term access keys to a group.

Full AWS Practitioner Certification Question