A team needs to securely store fixed one-time license keys that must be accessed by automation scripts running on EC2 instances and by CloudFormation stacks. Which cost-effective option should they use?

AWS Systems Manager Parameter Store SecureString parameters are the most cost-effective and secure option. SecureString parameters encrypt sensitive data using AWS Key Management Service (KMS) and are designed for storing configuration data and secrets. Automation scripts on EC2 instances can retrieve these parameters using the AWS SDK or CLI, and CloudFormation stacks can reference them directly. This centralizes secret management and integrates well with AWS services. Storing encrypted files in S3 is less convenient for programmatic access and doesn't offer the same level of integration for CloudFormation. AWS Secrets Manager is a valid option for secrets but is generally more expensive than Parameter Store for simple key-value pairs, as it includes features like automatic rotation that aren't needed here. CloudFormation NoEcho parameters prevent sensitive input from being displayed in the console but do not securely store or manage secrets for ongoing application use.