A company requires that all Amazon RDS instances be provisioned from AWS CloudFormation templates as part of an AWS CodePipeline CI/CD workflow. The database master password must be generated automatically during deployment. Which solution accomplishes this with the least development effort?

The correct solution leverages the native integration between AWS CloudFormation and AWS Secrets Manager. Declaring an AWS::SecretsManager::Secret resource directly within the CloudFormation template allows Secrets Manager to automatically generate a secure password and store it. This password can then be referenced using a secretsmanager dynamic reference when defining the RDS instance, minimizing development effort as it requires no custom code. Option 1 and 3 involve creating a CloudFormation custom resource backed by AWS Lambda. While functional, this adds unnecessary complexity and development effort compared to the native Secrets Manager integration. Option 2 uses CodeBuild to generate a password, but passing it as a CloudFormation parameter, even with NoEcho, is less secure and less integrated than using Secrets Manager directly for password generation and storage.