You are designing a serverless game application where users register and sign in via a web browser. Requests from the web app invoke Lambda functions behind an API Gateway HTTP API. You want a sign-in/registration solution that minimizes operational overhead and ongoing identity management. Which option meets these requirements?

Using Amazon Cognito user pools with external social identity providers and configuring IAM roles for identity pools is the correct choice because Cognito User Pools provide a fully managed identity service for user registration and sign-in, reducing operational overhead. Integrating with social identity providers simplifies the user experience. Identity pools then allow you to grant temporary, limited-privilege AWS credentials to authenticated users, enabling secure access to backend resources like Lambda functions without managing individual IAM users. Incorrect options: Creating IAM groups and roles programmatically for each user is operationally complex and not scalable for a large user base. An Amazon RDS for SQL Server instance requires significant operational overhead for identity management, user authentication, and authorization logic, which goes against the serverless principle. Storing user passwords in a DynamoDB table with an attached IAM policy is a security anti-pattern, as it would expose sensitive credentials and is not a secure or scalable authentication mechanism.