An application running on Amazon ECS requires several variables: remote API authentication data, the API URL, and credentials. The authentication info and API URL must be available to all current and future app versions across dev, test, and prod. Which approach retrieves these values with the FEWEST changes to the application?

The correct approach leverages AWS Systems Manager Parameter Store for non-sensitive configuration (API URL) and AWS Secrets Manager for sensitive data (credentials). Both services allow centralized management and retrieval of values, minimizing application changes. Parameter Store supports distinct paths for environments, and Secrets Manager securely stores and rotates credentials. Storing values in AWS KMS is incorrect because KMS is a key management service, not a general-purpose secret or parameter store. While it encrypts data, it's not designed for direct application configuration retrieval. Bundling encrypted files with the application is less flexible. It requires rebuilding and redeploying the application for any configuration changes, increasing operational overhead. Defining environment variables in the ECS task definition is suitable for some scenarios but doesn't offer the same centralized management and versioning capabilities as Parameter Store or Secrets Manager, especially for values that need to be updated independently of deployments or shared across multiple applications.