A company performs monthly maintenance and must rotate credentials for Amazon RDS for MySQL databases across multiple AWS Regions. Which solution meets this requirement with the least operational overhead?

AWS Secrets Manager is the most appropriate service for managing and rotating database credentials, offering built-in integration with Amazon RDS for automated rotation. Its multi-Region secret replication feature directly addresses the need to manage credentials across multiple AWS Regions with minimal effort. Configuring Secrets Manager to rotate secrets on a schedule automates the entire process, significantly reducing operational overhead. Storing credentials in AWS Systems Manager Parameter Store as secure strings is an option for secret storage, but it lacks the native, automated rotation capabilities for RDS that Secrets Manager provides, requiring custom solutions for rotation. Storing credentials in an Amazon S3 bucket is not designed for secure secret management and rotation, and would require significant custom development (Lambda, EventBridge) for rotation and security. Encrypting credentials with AWS KMS and storing them in DynamoDB is overly complex for this use case, requiring custom Lambda functions for both retrieval and rotation, which increases operational overhead compared to Secrets Manager's native features.