A developer needs the database connection string for a Lambda function to be changeable without modifying the function code, to simplify testing and deployments. What is the best way to meet this requirement?

Storing the connection string in AWS Secrets Manager is the best approach because it allows for centralized management and secure retrieval of sensitive information like database credentials. Secrets Manager integrates well with Lambda, enabling the function to retrieve the latest connection string dynamically at runtime without code changes. This simplifies testing (e.g., switching between dev/test/prod databases) and deployments. Storing it in an IAM user account is incorrect as IAM roles and users are for access control, not data storage. AWS KMS is for encryption, not storing secrets directly. A Lambda layer is for code and dependencies, not dynamic configuration values that change frequently or contain sensitive data.