Set up Amazon Cognito Identity Pools to federate supplier IdPs and issue temporary credentials for DynamoDB operations is correct because it allows Orion to trust external SAML or OIDC identity providers and to exchange their authentication tokens for short lived AWS credentials that are scoped to allow add and modify actions on the PartnerOrders and SupplierCatalog tables.

This solution uses Amazon Cognito Identity Pools to federate supplier IdPs and to obtain temporary AWS credentials via the AWS Security Token Service. You assign IAM roles with least privilege policies that restrict access to just the two DynamoDB tables and to only the necessary operations. Temporary credentials scale cleanly and avoid issuing long lived secrets or creating individual IAM principals for each external user.

Configure Amazon Cognito User Pools to sign in supplier users and authorize DynamoDB access is incorrect because user pools provide authentication and JWTs for applications and they do not by themselves grant AWS credentials for direct DynamoDB SDK access unless you pair them with an identity pool or proxy requests through a trusted backend.

Create an IAM user for each partner user and attach DynamoDB permissions is incorrect because creating per user IAM users produces long lived credentials that are hard to manage for many external partners and it does not follow federation or least privilege best practices.

AWS IAM Identity Center is incorrect because it is focused on workforce single sign on into AWS accounts and applications and it does not target issuing temporary AWS credentials to external application users for direct client SDK access to DynamoDB.

Full AWS Practitioner Certification Question