A company uses AWS Lambda functions that must connect to a Microsoft SQL Server DB instance on Amazon RDS. There are separate development and production environments; developers may access development credentials, but production credentials must be encrypted using a key that only members of the IT security team's IAM group can use. The key must be rotated regularly. What should a solutions architect implement in the production environment to satisfy these requirements?

Storing production database credentials in AWS Secrets Manager is the most secure and manageable solution. Secrets Manager allows for automatic rotation of credentials, which satisfies the requirement for regular rotation. It integrates with AWS KMS for encryption using a customer managed key, ensuring only authorized IT security personnel can decrypt and manage the key. IAM roles attached to Lambda functions provide fine-grained access control to retrieve the secret, adhering to the principle of least privilege. The other options are less suitable: Storing credentials in Systems Manager Parameter Store as a SecureString is a viable option for storing secrets, but it lacks the built-in automatic rotation feature that Secrets Manager provides for database credentials. Encrypting credentials with the AWS KMS default Lambda key and storing them in environment variables is less secure as environment variables can be inspected, and the default Lambda key might not meet the specific control requirements for the IT security team. Storing credentials directly in Lambda environment variables, even if encrypted with a customer managed key, is not ideal for secrets that require regular rotation and central management. Environment variables are not designed for automatic credential rotation.