An application running on EC2 uses an Amazon RDS for SQL Server database. Security requires database credentials to be rotated at least weekly. How should the developer configure credentials to meet this requirement?

AWS Secrets Manager is the most appropriate service for this requirement because it is designed to store, manage, and automatically rotate database credentials, API keys, and other secrets. By enabling automated rotation, Secrets Manager can rotate the credentials weekly (or even daily as suggested), meeting the security requirement without manual intervention. Storing credentials in Systems Manager Parameter Store as a secure string is possible, but it does not natively support automated rotation, requiring custom automation to achieve the weekly rotation. Enabling rotation of the KMS key encrypting the parameter only rotates the key, not the secret itself. IAM database authentication for RDS is a good security practice, but it manages authentication via IAM users/roles, not traditional database user password rotation, and doesn't directly address rotating a database user's password. Storing credentials in EC2 user data or environment variables is highly insecure and does not provide any rotation mechanism.