BlueSky Retail runs an Aurora PostgreSQL cluster for its order service. Security requires automatic rotation of the application user’s database password every 30 days without granting the application user ALTER USER privileges or exposing the master credentials to applications. What is the MOST appropriate solution?

The correct solution leverages AWS Secrets Manager's multi-user rotation feature. By storing both the application user secret and a superuser secret, Secrets Manager can use the superuser credentials to rotate the application user's password without granting the application user ALTER USER privileges or exposing master credentials to the application. This meets all requirements. IAM database authentication is not suitable because it doesn't involve password rotation for database users, and the question specifically asks for password rotation. Using Systems Manager Parameter Store with a Lambda function is a manual and less integrated approach compared to Secrets Manager's built-in rotation capabilities for databases. Enabling single-user rotation on the master user and having all services use it is a significant security risk, violating the principle of least privilege and exposing highly privileged credentials.