A serverless application in CodeCommit contains hardcoded database usernames and passwords. A DevOps engineer must automatically detect and prevent hardcoded secrets. Which is the MOST secure solution that meets these requirements?

The correct answer leverages Amazon CodeGuru Reviewer, which is designed to automatically detect hardcoded secrets and other code quality issues in your repositories, including CodeCommit. After detection, it provides recommendations, and the option to protect the secret directly integrates with AWS Secrets Manager, which is the most secure service for storing and managing sensitive information like database credentials. Updating the SAM templates and Python code to retrieve secrets from Secrets Manager ensures the application uses a secure, centralized secret management solution. Incorrect options: CodeGuru Profiler focuses on application performance, not security vulnerability detection like hardcoded secrets. Using AWS Systems Manager Parameter Store as a plain string for secrets is less secure than using Secrets Manager, which offers advanced features like automatic rotation, fine-grained access control, and integration with other AWS services.