A company runs an application on EC2 instances that connect to an Amazon RDS for SQL Server database. A developer needs to store and access the database credentials, enable automatic rotation, and avoid embedding credentials in code. Which is the MOST secure solution?

Storing credentials in AWS Secrets Manager is the most secure solution because it is purpose-built for managing secrets, offering automatic rotation, encryption at rest and in transit, and fine-grained access control. A Lambda function can be configured to handle the rotation process, updating both Secrets Manager and the RDS database. Applications can then retrieve credentials at runtime, avoiding hardcoding. IAM roles are for granting permissions to AWS services, not for storing database credentials directly. Storing credentials in an encrypted S3 text file or a DynamoDB table lacks the built-in rotation and secret management features of Secrets Manager, requiring more complex custom solutions for security and lifecycle management.