A company must follow security best practices when deploying resources from an AWS CloudFormation template. The template needs to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution meets the requirements?

Using a dynamic reference in the CloudFormation template to retrieve secrets from AWS Secrets Manager is the most secure and recommended approach. This method prevents sensitive data from being hardcoded or exposed in the template itself, adhering to security best practices. CloudFormation resolves the dynamic reference at deployment time, pulling the secret directly from Secrets Manager. Using a CloudFormation parameter to pass credentials and encrypting the template with AWS KMS is incorrect because encrypting the template does not secure the parameter value itself, which would still be exposed during deployment or in template history. Using a SecureString parameter in CloudFormation to reference Secrets Manager or AWS KMS is also incorrect. CloudFormation's NoEcho property for parameters only masks the output, it doesn't encrypt the value or prevent it from being stored in plain text in some contexts. Dynamic references are specifically designed for this integration.