A SysOps administrator must protect the credentials for an Amazon RDS instance that a CloudFormation template will create. The credentials must be stored encrypted and support automatic rotation. Which approach satisfies these requirements?

The correct approach is to define an AWS::SecretsManager::Secret resource in the CloudFormation template and use the resolve:secretsmanager dynamic reference. AWS Secrets Manager is designed for storing, retrieving, and rotating sensitive credentials like database passwords, meeting the encryption and automatic rotation requirements. The resolve:secretsmanager dynamic reference allows CloudFormation to fetch the secret value at deployment time. Using resolve:ssm-secure is incorrect because it's for AWS Systems Manager Parameter Store, not Secrets Manager. While Parameter Store can store encrypted parameters, it doesn't offer built-in automatic rotation for database credentials like Secrets Manager does. Defining an AWS::SSM::Parameter with resolve:ssm is also incorrect as it lacks the automatic rotation feature and resolve:ssm is for plain text or encrypted parameters, not specifically secrets. Declaring template parameters for credentials is insecure as they are exposed in the template and lack encryption and rotation capabilities.