A company needs to give a globally distributed development team secure access to AWS resources in compliance with security policies. The company uses an on-premises Active Directory for internal authentication and AWS Organizations to manage multiple AWS accounts across projects. The company wants a solution that integrates with existing infrastructure and provides centralized identity management and access control with the LEAST operational overhead. Which solution meets these requirements?

The correct solution leverages AD Connector to integrate with the existing on-premises Active Directory without requiring a full AD replica in AWS, minimizing operational overhead. Integrating AD Connector with AWS IAM Identity Center (formerly AWS SSO) provides centralized identity management across multiple AWS accounts within AWS Organizations. Permission sets in IAM Identity Center allow granular access control by mapping AD groups to specific AWS accounts and resources, aligning with security policies and providing a scalable solution for a globally distributed team. Creating individual IAM users is not scalable or efficient for a large, globally distributed team and increases operational overhead for user and permission management. Setting up an AWS Managed Microsoft AD with a trust relationship is a valid option but has higher operational overhead and cost than AD Connector, as it involves deploying and managing a full directory service in AWS. Amazon Cognito is primarily for customer-facing applications and user pools, not typically for enterprise workforce identity federation with on-premises Active Directory for AWS resource access, making it an unsuitable choice here.