A company using AWS Organizations needs to provide short-term credentials to third-party AWS accounts for access to accounts in the organization, for both AWS Management Console and third-party SaaS application access. The solution must strengthen trust to prevent two external accounts from using the same credentials and require minimal operations. Which solution meets these needs?

The sts:ExternalId condition key is designed to prevent the confused deputy problem when granting cross-account access to third parties. By requiring the third party to provide a unique ExternalId when assuming the role, it ensures that only the intended third-party account can use the credentials, even if another external entity somehow obtains the role ARN. This strengthens trust and provides short-term credentials for both console and programmatic access. Using bearer token authentication with OAuth or SAML is more complex and less direct for cross-account AWS resource access. AWS IAM Identity Center (AWS Single Sign-On) is excellent for managing access for internal users but is not primarily designed for granting temporary, controlled access to external AWS accounts. Creating a random external key with AWS Secrets Manager is less secure and scalable than using sts:ExternalId directly within the trust policy, as it requires managing and distributing secrets.