Company policy mandates that all API keys be encrypted and stored in a centralized security account managed by the security team, separate from source code. An audit found an API key committed with the source of an AWS Lambda function in an AWS CodeCommit repository in the DevOps account. How should the security team store the API key securely?

Storing the API key in AWS Secrets Manager in the security account, encrypted with AWS KMS, is the most secure and compliant method. Secrets Manager is designed for storing and rotating sensitive credentials, and granting the Lambda function's IAM role permission to retrieve the secret ensures least privilege access. The Lambda function can then retrieve the key at runtime, preventing it from being hardcoded or stored insecurely. Storing the key in a CodeCommit repository (even encrypted) is not ideal for secrets, as repositories are for source code, not dynamic credentials. Using an S3 bucket with a presigned URL adds unnecessary complexity and potential exposure points compared to Secrets Manager. Encrypting an environment variable with KMS is better than plain text, but Secrets Manager offers more robust features like automatic rotation and fine-grained access control, which are critical for API keys.