A consulting agency needs temporary access to a company’s production AWS account for a security audit. Multiple consultants will require access. The agency has its own AWS account. The company mandates MFA for all access and prohibits long-term credentials. Which solution meets these requirements?

The correct solution is to create an IAM role in the company's production account with a trust policy that specifies the consulting agency's AWS account as the principal and requires MFA. This allows consultants from the agency to assume the role, gaining temporary access to the production account without creating individual IAM users for them. The MFA requirement in the trust policy ensures strong authentication. Creating IAM users in the company's account for each consultant (option 1) is not ideal for temporary access and violates the "no long-term credentials" mandate. Configuring Amazon Cognito (option 2) is overkill for this scenario, as it's typically used for application user management, not cross-account access for AWS resources. Creating an IAM role in the consulting agency's account (option 3) would not grant access to the company's production account; the role must reside in the resource-owning account.