A CloudFormation template deploys an Amazon Linux EC2 instance, an Amazon Aurora cluster, and includes a hardcoded database password that must be rotated every 90 days. What is the most secure method to manage and rotate this database password?

The most secure method involves using AWS Secrets Manager to generate, store, and automatically rotate the database password. AWS::SecretsManager::Secret with GenerateSecretString ensures a strong, unique password is created. AWS::SecretsManager::RotationSchedule automates the 90-day rotation requirement, eliminating manual intervention and reducing the risk of forgotten rotations. The application then retrieves the current password from Secrets Manager at runtime, avoiding hardcoding. Storing the password as a SecretString via a CloudFormation parameter still requires manual password generation and doesn't automate rotation. Using AWS::SSM::Parameter (whether SecureString or plain string) for the password doesn't offer built-in automatic rotation capabilities, requiring a separate mechanism to meet the 90-day rotation requirement. Plain string storage in SSM Parameter Store is also less secure than SecureString or Secrets Manager.