A manufacturing company uses an RDS instance for inventory and has several Lambda functions that connect to the database using hardcoded credentials. Credentials must never be stored in plaintext and must be rotated every 30 days. Which solution provides this with the least operational overhead?

Storing credentials in AWS Secrets Manager is the most secure and operationally efficient solution. Secrets Manager can automatically rotate database credentials for supported services like RDS, eliminating the need for a custom rotation Lambda and EventBridge schedule. It also ensures credentials are never stored in plaintext and are retrieved securely at runtime by the Lambda functions. The other options involve manual or custom rotation logic, increasing operational overhead. Storing credentials as environment variables (even encrypted) or in Parameter Store requires a custom Lambda to handle both password rotation in the database and updating the stored secret, which is less integrated and more complex than Secrets Manager's native rotation capabilities.