A company runs a payment application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group across multiple Availability Zones. The application must retrieve secrets at startup and export them as environment variables. Secrets must be encrypted at rest and rotated monthly. Which solution meets these requirements with the least development effort?

Storing secrets in AWS Secrets Manager meets all requirements with the least development effort. Secrets Manager encrypts secrets at rest, supports customer-managed KMS keys, and offers automatic rotation, which simplifies compliance. An EC2 user data script can easily retrieve these secrets at startup and export them as environment variables, as Secrets Manager integrates well with EC2. Incorrect options: Storing secrets in S3 requires manual rotation via S3 Object Lambda, which is more complex than Secrets Manager's built-in rotation. It also requires custom code to parse the text file. Systems Manager Parameter Store can store secrets, but its rotation mechanism is not automatic and requires a custom Lambda function, increasing development effort compared to Secrets Manager's native rotation. Embedding secrets as base64-encoded environment variables in application properties is insecure, difficult to manage, and requires a custom script for rotation, which is prone to errors and high effort.