A CodeBuild stage in a deployment pipeline needs database credentials to run integration tests. Company policy mandates automatic rotation of all database credentials. Which method securely supplies rotating credentials to the build with the least operational overhead?

AWS Secrets Manager is the most secure and operationally efficient solution for managing and rotating database credentials. It natively supports automatic rotation for various database types, including those commonly used with AWS. By linking an environment variable to a Secrets Manager secret, CodeBuild can retrieve the latest credentials at runtime without exposing them in the buildspec.yml. Hardcoding credentials is a security risk and doesn't support rotation. While Systems Manager Parameter Store can store SecureStrings, it lacks native automatic rotation for database credentials, requiring custom solutions. Storing plaintext connection strings in environment variables is highly insecure, and EventBridge alone doesn't provide credential storage or rotation capabilities; it's an event bus.