A company automates bootstrapping of new EC2 instances using CloudFormation templates that run scripts containing sensitive values. The solution must integrate with CloudFormation and securely manage those secrets. Which option provides the most secure integration with CloudFormation?

Storing sensitive values as SecureString parameters in AWS Systems Manager Parameter Store is the most secure and integrated solution. SecureString encrypts the parameter value using AWS KMS, ensuring the secrets are protected at rest and in transit. CloudFormation can then dynamically reference these parameters, allowing the bootstrap scripts to retrieve the secrets securely at runtime without hardcoding them in templates. Placing sensitive values in CloudFormation parameters and encrypting the template is less secure because parameters are visible in the CloudFormation console and API calls, even if the template file itself is encrypted. Storing secrets in S3 is better than directly in templates, but S3 is not purpose-built for secret management and requires careful access control configuration. Storing secrets on Amazon EFS is not ideal for bootstrapping EC2 instances, as EFS setup and mounting add complexity and potential security risks during initial instance launch, and it's not a dedicated secret management service.