An application running in ECS Fargate behind an ALB stores database credentials inside the application. The company wants to store credentials more securely and enable periodic rotation with minimal operations effort. Which solution best meets these requirements?

AWS Secrets Manager is the most suitable service for securely storing and rotating database credentials. It integrates with AWS KMS for encryption, automatically rotates secrets, and allows fine-grained access control via IAM roles, ensuring only authorized ECS Fargate tasks can retrieve credentials. Incorrect options: Storing secrets in Amazon RDS parameter groups is not designed for application-level secret management and rotation. AWS Systems Manager Parameter Store can store secrets but lacks the built-in automatic rotation capabilities that Secrets Manager offers, requiring more operational effort for rotation. Storing credentials as ECS Fargate environment variables is insecure and does not provide encryption or automatic rotation, failing to meet the security and operational requirements.