The correct service for centralized control over identities and access management in the cloud is IAM. IAM allows the creation and management of users, groups, roles, and policies to securely control access to resources. Amazon Cognito is primarily used for adding user sign-up, sign-in, and access control to web and mobile applications. Amazon Resource Access Manager (RAM) is focused on sharing resources across accounts, and AWS Directory Service is intended for directory-based identity-related features.