Third-party sign-in (Federation) has been implemented in your web application to allow users who need access to AWS resources. Users have been successfully logging in using Google, Facebook, and other third-party credentials. Suddenly, their access to some AWS resources has been restricted. What is the most likely cause of the restricted use of AWS resources?

Answer options:

A.IAM policies for resources were changed, thereby restricting access to AWS resources.
B.Federation protocols are used to authorize services and need to be updated.
C.IAM groups for accessing the AWS resources were changed, thereby restricting their access via federated login.
D.The identity providers no longer allow access to AWS services.

Correct Answer: A
Users of your app can sign in using a well-known external identity provider (IdP), such as Login with Amazon, Facebook, Google, or any other OpenID Connect (OIDC)-compatible IdP. They can receive an authentication token, and then exchange that token for temporary security credentials in AWS that map to an IAM role with permissions to use the resources in your AWS account. 
Option A is correct. When IAM policies are changed, they can impact the user experience and services they can connect to.
Option B is incorrect. Federation is used to authenticate users, not to authorize services.
Option C is incorrect. "IAM groups for accessing the AWS resources" is NOT the correct usage, as IAM role(s) must be attached.
Option D is incorrect. The identity providers don’t have the capability to authorize services; they authenticate users.
References:
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html