A company deploys AWS Lambda functions that connect to an Amazon RDS for PostgreSQL database in QA and production environments. Credentials must not be embedded in application code and database passwords must be rotated automatically. Which solution meets these requirements?

AWS Secrets Manager is the most suitable solution because it is designed for storing, retrieving, and automatically rotating database credentials, API keys, and other secrets. Storing separate secrets for QA and production environments allows for independent management and rotation, which is a best practice. Supplying a reference as an environment variable to Lambda functions is a secure way to inject these secrets at runtime without embedding them in code. Storing credentials in AWS Systems Manager Parameter Store with KMS encryption would meet the non-embedding and encryption requirements, but it does not natively support automatic rotation of database passwords, which is a key requirement. AWS KMS is a key management service and is not designed for storing or rotating credentials directly; it encrypts data. Storing credentials in Amazon S3 buckets, even with SSE-KMS, is not ideal for credential management and rotation, and it requires custom logic for retrieval and rotation, which is less secure and more complex than using Secrets Manager.