A serverless application must store sensitive API keys as environment variables and requires automatic yearly rotation of the encryption keys. The company wants a solution that requires no application development effort. Which option meets these needs?

Storing sensitive API keys in AWS Secrets Manager and enabling automatic rotation directly addresses the requirements. Secrets Manager is designed for storing and managing secrets like API keys, and it natively supports automatic rotation, including yearly rotation, without requiring any application code changes. Encrypting environment variables with a KMS customer-managed key and enabling automatic KMS key rotation only encrypts the keys; it doesn't store the API keys themselves or provide automatic rotation of the API keys. Encrypting with AWS-managed KMS keys and building a Lambda function to rotate keys requires development effort, which the prompt explicitly states should be avoided. Storing and encrypting in AWS Systems Manager Parameter Store is a viable option for storing secrets, but Parameter Store does not offer native automatic rotation of the stored secrets themselves.