IAM User is correct because an access key ID and matching secret access key are long term programmatic credentials that are tied to an identity and belong to an IAM User.

An IAM User can have up to two active access keys that a build server or other automation can use for direct API calls. These keys persist until you rotate or delete them and they are distinct from temporary credentials that are issued when assuming a role.

IAM Role is intended to be assumed and provides temporary credentials via AWS Security Token Service and it does not issue long lived access key ID and secret access key pairs.

IAM Policy is only a JSON document that defines permissions and it does not contain or provide credentials such as access keys.

Amazon Cognito user pool manages application user identities and issues tokens for sign in and it does not provide IAM access keys for calling AWS APIs.

Full AWS Practitioner Certification Question