A Lambda function needs rotated database credentials and secure storage, and integration with Lambda should require minimal management. Which solution should the developer choose to store, rotate, and provide the RDS credentials to the Lambda function with the least operational overhead?

AWS Secrets Manager is the most suitable solution for storing, rotating, and providing RDS credentials to a Lambda function with minimal operational overhead. It natively supports automatic rotation of database credentials, including RDS, and integrates directly with Lambda for retrieval. The default KMS key provides encryption, fulfilling the secure storage requirement. Storing credentials in Systems Manager Parameter Store would require custom rotation logic, increasing operational overhead. Encrypting credentials as environment variables or in DynamoDB, even with a second Lambda for rotation, introduces significant management complexity and custom development, which contradicts the requirement for minimal management. Secrets Manager is designed for this specific use case, offering built-in features that simplify credential management and rotation.