A multi-tier web application uses an Amazon Aurora MySQL DB cluster for storage and EC2 instances for the application tier. IT security requires that database credentials be encrypted and rotated every 14 days. What should a solutions architect do to meet this requirement with the LEAST operational effort?

The correct option leverages AWS Secrets Manager, which is specifically designed for securely storing, managing, and rotating database credentials and other secrets. It natively integrates with Aurora MySQL, allowing direct association and automated rotation using a custom schedule (like 14 days) with minimal operational overhead. Secrets Manager handles the encryption using KMS and the rotation logic automatically. Incorrect options: Using Systems Manager Parameter Store with a Lambda function for rotation requires custom development and maintenance for the rotation logic, increasing operational effort compared to Secrets Manager's built-in functionality. Storing credentials in EFS or S3 with a custom Lambda for rotation introduces more complexity, requires managing file access, and lacks the direct, automated integration and rotation capabilities that Secrets Manager offers for database credentials. These methods are also less secure and auditable for secret management.