A bank runs payment workers on premises and in another cloud that must call S3 and SQS without storing long-lived AWS keys, with short-lived credentials and centralized trust rotation. Security forbids exporting service account passwords to AWS. Which workload identity design grants hybrid workers secure temporary AWS access?

IAM Roles Anywhere is correct because it creates AWS trust anchors for the bank's private certificate authority, allowing on-premises and other-cloud payment workers presenting valid X.509 certificates to call STS for short-lived role credentials for S3 and SQS, eliminating long-lived keys, centralizing rotation by updating the anchor or issuing CA without redeploying secrets, and using certificate authentication so no service account passwords are exported. Other-cloud OIDC federation fails on coverage because it depends on that cloud's OIDC issuer and IAM provider to mint STS tokens, which works inside that cloud but leaves on-premises workers with no OIDC issuer unable to federate, breaking hybrid access. Active Directory SAML federation fails on workload fit because SAML to IAM roles is built for workforce authentication via a central IdP with AD-joined context, needing interactive or domain-joined assertions unsuited to unattended headless daemons and offering no coverage for non-AD workers in the other cloud. Cognito identity pools fails on purpose because it targets consumer mobile and web apps using app clients and OIDC tokens, lacking X.509 anchors, private-CA rotation, and audit controls for payments. Exam caveat: with on-premises plus another cloud plus X.509, trust anchors, and banned password export, prefer Roles Anywhere even when all promise temporary credentials. Practical check: verify the anchor points to the current CA, confirm one-hour sessions, and check CloudTrail for assumed-role S3 and SQS calls with no IAM user keys.