An existing application with hardcoded DB credentials is deployed in two Regions in an active-passive failover setup. You must move credentials out of code and meet the disaster-recovery strategy. Which is the MOST secure solution that satisfies the multi-Region requirement?

Storing credentials in AWS Secrets Manager is the most secure and recommended approach for managing sensitive information. Secrets Manager provides features like automatic rotation, fine-grained access control, and encryption, which are crucial for security. Enabling secret replication to the secondary Region directly supports the active-passive failover and disaster recovery strategy by ensuring credentials are available in both regions. Updating the application to use the ARN based on the Region allows it to dynamically retrieve the correct secret for its current operating region. Storing credentials in AWS Systems Manager Parameter Store is less secure than Secrets Manager for highly sensitive data like database credentials, as it lacks automatic rotation and advanced secret management features. Storing credentials in a config file in S3, even with Cross-Region Replication, is less secure because S3 is not designed for secret management, and the credentials would be stored as plain text or require additional encryption mechanisms. Using Amazon EFS for a config file is also less secure and introduces unnecessary complexity for credential management, as EFS is a file system service, not a secret management service.