A compliance requirement mandates that admin passwords for RDS DB instances be rotated at least once per year. Which approach meets this requirement with the least operational overhead?

Storing DB credentials in AWS Secrets Manager and enabling automatic rotation every 365 days is the most efficient solution. Secrets Manager is designed for managing and rotating credentials, including those for RDS databases. It integrates directly with RDS to handle the rotation process automatically, minimizing operational overhead. Placing credentials in an RDS parameter group is not a secure or practical method for credential management or rotation. Implementing a DB trigger for password rotation is complex and not a standard security practice. Storing credentials in a private S3 bucket and using a Lambda function would require custom development and maintenance, increasing operational overhead compared to Secrets Manager's built-in functionality. While Systems Manager Parameter Store can store secure strings, it lacks the native automatic rotation capabilities for RDS that AWS Secrets Manager provides, making it less suitable for this specific requirement.