A process automatically retrieves API credentials for multiple banking sources and invokes a Lambda function tied to a CloudFormation custom resource. The developer wants to store these API credentials with minimal operational overhead and maximum security. Which approach is the most secure and requires the least operational effort?

Storing credentials as a SecureString in AWS Systems Manager Parameter Store via the PutParameter API from the Lambda function is the most secure and operationally efficient. SecureString encrypts the parameter value using AWS KMS, providing robust security. Using PutParameter from Lambda means the credentials are never exposed in CloudFormation templates or logs, reducing the risk of accidental exposure. Incorrect options: Adding GenerateSecretString to CloudFormation is for generating new secrets, not storing existing ones. Adding an SSM Parameter Store resource directly to CloudFormation with NoEcho still means the credentials are part of the template, even if obscured, which is less secure than storing them dynamically. Calling PutParameter from Lambda and setting NoEcho is insufficient; NoEcho only prevents the value from being displayed in CloudFormation console output, it doesn't encrypt the stored value like SecureString does.