An application running on Amazon EC2 must send a chat message to the company’s support team when it detects an invalid transaction. To call the chat API it needs an access token that must be encrypted at rest and in transit and must be accessible from other AWS accounts. Which approach provides these requirements while minimizing management overhead?

AWS Secrets Manager is the most suitable service for storing sensitive credentials like access tokens, as it automatically handles encryption at rest and in transit, and offers features like rotation and fine-grained access control. Using a customer-managed key (CMK) with KMS allows for cross-account access via a resource-based policy, meeting the requirement for accessibility from other AWS accounts. The EC2 instance's IAM role can then be granted permission to retrieve the secret, which Secrets Manager decrypts automatically upon retrieval. Storing the token in Systems Manager Parameter Store SecureString with an AWS-managed key doesn't inherently support cross-account access via resource policies on the parameter itself for the KMS key used. DynamoDB and S3 are general-purpose storage services; while they can store encrypted data, they lack the specialized features for secret management that Secrets Manager provides, leading to higher management overhead for features like rotation and secure retrieval.