A security audit found that a development team committed IAM user secret access keys inside application code to an AWS CodeCommit repository. The security team wants an automated mechanism to detect and remediate these exposed credentials so they are secured automatically. Which solution will ensure credentials are discovered and remediated automatically?

The correct solution uses a CodeCommit trigger to invoke an AWS Lambda function upon every code submission. This provides immediate detection of exposed credentials. The Lambda function can then scan the new commits, disable the compromised IAM credentials, and notify the user, ensuring automated and timely remediation. The other options are less effective: Running a nightly script via Systems Manager Run Command on development instances is reactive and could miss credentials committed earlier in the day, leaving them exposed for an extended period. It also doesn't directly scan the CodeCommit repository for historical commits. Scheduling an AWS Lambda function to download and scan the CodeCommit repository is also reactive and not real-time. It introduces a delay between exposure and detection. Storing new credentials in KMS doesn't address the immediate remediation of the exposed ones. Amazon Macie is designed for data discovery and classification in S3, not for real-time scanning of CodeCommit repositories for exposed credentials in code.