Pick the right Cognito token

At NimbusCart, the mobile app signs shoppers in with Amazon Cognito and now needs temporary AWS credentials so each shopper can upload to Amazon S3. Use the Cognito flow explorer to sign a user in to the User Pool and watch it issue the ID, access, and refresh tokens. Click each token chip to read what it carries, then follow the arrow showing the ID token being exchanged at the Identity Pool for temporary AWS credentials.

Question: NimbusCart's app has signed a shopper in with Amazon Cognito and now needs temporary AWS credentials to let that shopper upload to Amazon S3 via an Identity Pool. Which token does it exchange at the Identity Pool?