An application needs temporary, limited-permission credentials to call other AWS APIs. Which AWS service or feature provides these short-lived credentials?

AWS Security Token Service (AWS STS) is the correct answer because it enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users you authenticate (federated users). These temporary credentials are ideal for applications needing to assume roles or access resources with specific, time-bound permissions, enhancing security by reducing the risk associated with long-term credentials. Amazon API Gateway is incorrect because it is a fully managed service that helps developers create, publish, maintain, monitor, and secure APIs at any scale, not for issuing temporary credentials. IAM users are long-term credentials for individuals or services, not temporary. IAM instance profiles are containers for an IAM role that can be attached to an EC2 instance, allowing the instance to assume the role's permissions, but AWS STS is the underlying service that issues the temporary credentials when the role is assumed.