A developer manages many secrets in AWS Secrets Manager used by several applications. Over time some secrets are rotated or no longer used. The developer needs to determine which Secrets Manager secrets are currently used by applications without causing downtime. What approach should the developer take?

The correct approach is to enable the AWS Config managed rule secretsmanager-secret-unused and create an EventBridge rule for notifications. This AWS Config rule specifically identifies secrets that haven't been accessed for a configurable period, directly addressing the need to find unused secrets without impacting applications. EventBridge then automates notifications, making the process efficient. Enabling CloudTrail and monitoring GetSecretValue API requests could show all secret usage, but wouldn't directly identify unused secrets without complex analysis. Temporarily deactivating secrets would cause downtime, which the question explicitly states to avoid. AWS X-Ray helps trace application requests and identify GetSecretValue calls, but like CloudTrail, it focuses on used secrets rather than directly identifying unused ones, and requires application-level instrumentation.