A company uses a custom root certificate authority (Root CA) chain (10 KB) to issue SSL certificates for on-premises HTTPS endpoints. Hundreds of AWS Lambda functions pull data from these endpoints. A developer initially bundled the Root CA certificate file inside each Lambda deployment package and updated the execution environment trust store when the environment initializes. After 3 months the Root CA has changed and must be updated. The developer needs a solution that lets the Root CA certificate be updated for all deployed Lambda functions without rebuilding or redeploying each function, across separate AWS accounts for dev, test, and prod. Which two steps together meet these requirements most cost-effectively? (Choose two.)

Storing the Root CA certificate in AWS Secrets Manager allows for centralized management and secure retrieval. Secrets Manager supports automatic rotation and fine-grained access control via resource policies, making it suitable for sensitive data like certificates. Refactoring Lambda functions to load the certificate at runtime, outside the handler, ensures the certificate is loaded once per execution environment initialization, minimizing overhead and allowing updates without redeployment. This combination meets the requirements for updating the certificate across environments without rebuilding or redeploying functions, and is cost-effective as Secrets Manager and Lambda are pay-as-you-go services. Storing it in Parameter Store as a SecureString is also an option, but Secrets Manager is generally preferred for sensitive secrets due to features like automatic rotation. Placing it in S3 is less secure for sensitive data and lacks built-in secret management features. Updating the trust store inside the handler would incur unnecessary overhead on every invocation.