An existing application currently reads database credentials from an encrypted file in Amazon S3. For the next version, the security engineer requires: strong randomly generated database passwords stored in a secure AWS-managed service; deployment of application resources via AWS CloudFormation; and automated credential rotation every 90 days. You will author a CloudFormation template to deploy the application. Which CloudFormation resources satisfy these requirements with the LEAST operational overhead?

The correct option leverages AWS Secrets Manager, which is designed for managing, retrieving, and rotating database credentials and other secrets. Storing the password as an AWS Secrets Manager secret resource satisfies the requirement for strong, randomly generated passwords in a secure, AWS-managed service. The AWS::SecretsManager::RotationSchedule CloudFormation resource directly integrates with Secrets Manager to automate credential rotation, including invoking a Lambda function for custom rotation logic, thus meeting the 90-day rotation requirement with minimal operational overhead. Incorrect options: Using Systems Manager Parameter Store SecureString is suitable for storing secrets but lacks native, automated rotation capabilities like Secrets Manager. The "hypothetical Parameter Store RotationSchedule" does not exist. While an EventBridge rule could trigger a Lambda for rotation, AWS::SecretsManager::RotationSchedule is a more integrated and purpose-built solution for secret rotation, offering lower operational overhead. AWS AppSync DataSource is unrelated to credential storage or rotation.