An Amazon API Gateway API invokes an AWS Lambda function that must call a SaaS platform. The SaaS platform issues a unique client token to authorize the Lambda function. A security engineer must encrypt the token at rest and supply it to the Lambda function at runtime in the most cost-effective way. Which solution meets these requirements?

Storing the token as a SecureString in AWS Systems Manager Parameter Store is the most cost-effective solution. SecureString parameters are encrypted at rest using AWS Key Management Service (KMS) and are designed for storing sensitive data like API keys and tokens. Retrieving it with the AWS SDK within the Lambda function is a standard, secure practice. This approach is generally more cost-effective than AWS Secrets Manager for simple secrets, as Parameter Store offers a free tier for a significant number of parameters. AWS Secrets Manager is a valid option for storing secrets and offers features like automatic rotation, but it can be more expensive if those advanced features are not required. A token-based Lambda authorizer in API Gateway is for authorizing API calls, not for storing and retrieving a token for an outbound call from a Lambda function. Encrypting the token with KMS and passing it as an environment variable is less secure, as environment variables are not encrypted at rest by default and can be inadvertently exposed.