A production static website in S3 invokes an Aurora PostgreSQL database via a Lambda function. The site uses a Lambda alias that points to a specific function version. Database credentials must be rotated every two weeks, and older deployed Lambda versions must be able to access the latest credentials. Which solution satisfies these requirements?

Storing database credentials in AWS Secrets Manager with rotation enabled is the most secure and scalable solution. Secrets Manager automatically rotates credentials, meeting the two-week rotation requirement. Lambda functions can retrieve the latest credentials at runtime, ensuring that older deployed Lambda versions (accessed via the alias) always get the current, valid credentials without needing redeployment. Embedding credentials in code or environment variables requires manual updates and redeployment of the Lambda function for every credential change, which is inefficient and error-prone, especially for older versions. Systems Manager Parameter Store can store credentials, but it doesn't natively offer automatic rotation for database credentials like Secrets Manager does, making it less suitable for the specified rotation requirement.