An AWS access key ID and matching secret access key are the correct credentials required to authenticate AWS CLI and SDK calls that originate from the corporate data center and traverse the public internet.

These credentials are long term access keys that the CLI and SDK use to sign API requests and establish identity and permissions. The CLI and SDK include the An AWS access key ID and matching secret access key pair when creating signed requests so AWS can authenticate and authorize the call. When services run inside AWS you can use IAM roles and temporary credentials instead but external programmatic access requires an access key pair or an equivalent signed credential mechanism.

Amazon API Gateway is a managed service for publishing and operating custom APIs and it is not needed to invoke native AWS service APIs with the CLI or SDK.

An Amazon EC2 key pair is for SSH or RDP access to virtual machines and it does not provide authentication for AWS API calls.

AWS Direct Connect provides private network connectivity and it does not replace credential based request signing for programmatic access.

Full AWS Practitioner Certification Question