A containerized application needs to call a third-party service using API keys. The developer needs a secure method to store the keys and provide them to the containers. Which of the following are appropriate? (Choose two.)

Both AWS Systems Manager Parameter Store (using SecureString) and AWS Secrets Manager (using SecretString) are designed for securely storing sensitive data like API keys. By granting the application appropriate IAM permissions to retrieve these parameters or secrets, the application can access the keys at runtime without exposing them in code or configuration files. This follows the principle of least privilege and secure credential management. Storing API keys in CloudFormation templates (even base64 encoded) or as CloudFormation parameters is insecure because CloudFormation templates are often version-controlled and can be publicly accessible, exposing the keys. Hard-coding keys directly into the application image is also a significant security risk, as it embeds sensitive data directly into the artifact, making it difficult to rotate and prone to exposure if the image is compromised.