An organization centrally manages users from an operations account and disallows creating users in workload accounts. The operations team needs administrator access to each workload account. Which combination of actions will provide that access? (Choose three.)

The correct approach involves creating an IAM user for each operations team member in the operations account, as users cannot be created in workload accounts. Next, a SysAdmin IAM role with AdministratorAccess should be created in each workload account. The trust policy for these SysAdmin roles must be configured to allow the operations account to assume them. Finally, in the operations account, an IAM group (e.g., SysAdmins) is created. This group will have a policy attached that grants sts:AssumeRole permissions to the SysAdmin role in each workload account, and all operations team members are added to this group. This setup enables operations team members to assume the administrative role in workload accounts from their central operations account. Incorrect options: Creating a SysAdmin role in the operations account with a trust policy allowing sts:AssumeRole from workload accounts is incorrect because the administrative role needs to reside in the target workload accounts, not the source account. Amazon Cognito identity pools and user pools are for managing external identities or web/mobile app users, not for granting cross-account administrative access to internal operations teams.