A company stores sensitive credentials for applications in development, staging, pre-production, and production. Credentials must be encrypted, automatically rotated, and each environment must have its own version of the credentials. What is the most operationally efficient solution?

Creating a separate secret in AWS Secrets Manager for each environment (development, staging, pre-production, production) is the most operationally efficient solution. Secrets Manager natively supports encryption, automatic rotation, and fine-grained access control, which are all critical requirements. Each environment having its own secret ensures isolation and simplifies management, as rotation schedules and access policies can be independently configured per environment. Using Secrets Manager versions to keep separate copies of the same credential across environments is incorrect because versions are typically used for tracking changes to a single secret over time, not for managing distinct secrets across different environments. Creating a new Systems Manager Parameter Store parameter version for each environment is less ideal because while Parameter Store can store secrets, Secrets Manager offers more robust features like automatic rotation and integration with other AWS services for credential management. Using environment variables in the application code is insecure and not scalable for sensitive credentials, as it exposes them directly in the application environment and lacks rotation capabilities.