I think it's D, as Cognito is more for third-part applications like credentials for facebook, etc.

I believe it's correct because "The AWS access portal provides IAM Identity Center users with single sign-on access to all their assigned AWS accounts and applications through a web portal." So it's centrally managed. And: ". Use IAM Identity Center with your existing identity source or create a new directory, and manage workforce access to part or all of your AWS environment."

Can someone please check if B is actually the right answer?

Per Copilot: The AWS service that will meet these requirements is Amazon Cognito. It provides a comprehensive solution for managing sign-in security, user authentication, and access control across multiple AWS accounts and applications.