A developer is creating a CloudFormation custom resource backed by a Lambda function to configure an Amazon OpenSearch Service domain. The Lambda must use the OpenSearch internal master user credentials to access the domain. What is the most secure way to provide these credentials to the Lambda function?

Using AWS Secrets Manager is the most secure method. It allows you to store, manage, and retrieve sensitive credentials, including master user passwords, securely. CloudFormation can create the secret, and a dynamic reference ensures the OpenSearch domain uses the correct credentials without exposing them in the template. The Lambda function, granted secretsmanager:GetSecretValue permissions via its IAM role, can then retrieve the secret at runtime, ensuring credentials are never hardcoded or exposed in environment variables. Passing credentials directly as CloudFormation parameters or environment variables, even with NoEcho=true, is less secure as they can still be viewed in console or logs. While Systems Manager Parameter Store is better than direct environment variables, Secrets Manager offers more robust secret rotation and management features specifically designed for sensitive credentials. Encrypting with KMS is good, but Secrets Manager provides a complete solution for secret lifecycle management.