A company needs to provide secure, encrypted-at-rest database credentials with scheduled rotation for its AWS-hosted databases (Amazon RDS, Amazon DocumentDB, and Amazon Aurora). Which solution meets these security and rotation requirements most securely?

AWS Secrets Manager is the most secure and efficient solution because it is purpose-built for storing, managing, and automatically rotating database credentials and other secrets. It natively integrates with Amazon RDS, DocumentDB, and Aurora, providing pre-built Lambda blueprints like SecretsManagerRotationTemplate to simplify the implementation of scheduled rotation. This ensures credentials are regularly updated without manual intervention, enhancing security. IAM database authentication is good for centralized access but doesn't manage the rotation of the underlying database credentials themselves. AWS Systems Manager Parameter Store SecureString can store encrypted credentials but lacks native, automatic rotation capabilities for database credentials. Storing credentials in Amazon S3, even encrypted and with public access blocked, is not designed for secret management or automatic rotation, making it less secure and more complex to manage than Secrets Manager.