A company’s online game stores player usernames and passwords in an Amazon Aurora database. With hundreds of thousands of users, password reset and login assistance requests are overwhelming the customer service team. The company needs to provide an alternative login method that offloads password management while securely protecting player credentials. Which solution should the company implement?

Amazon Cognito user pools provide a scalable and secure identity directory for web and mobile applications, offloading password management. Federating with third-party identity providers (IdPs) like social logins further reduces the burden on customer service by allowing players to use existing, trusted accounts. This solution directly addresses the problem of overwhelming password reset requests and securely protects credentials. Creating IAM access keys for players is inappropriate; IAM is for AWS resource access, not application user authentication, and storing keys on devices is insecure. Migrating credentials to AWS Secrets Manager is not a complete authentication solution; Secrets Manager is for storing secrets, not managing user identities or providing authentication flows. Replacing username/password with API keys is less secure and less user-friendly for general player authentication compared to Cognito.