Credentials used to connect to an external SaaS provider are currently stored in plaintext in a configuration file. The developer must secure these API credentials and enforce automatic rotation every quarter. Which solution provides the most secure approach?

Storing credentials in AWS Secrets Manager is the most secure approach because it is specifically designed for managing and rotating secrets like API keys, database credentials, and other sensitive information. Secrets Manager natively supports automatic rotation, which directly addresses the requirement for quarterly rotation. The application can retrieve these secrets programmatically, ensuring they are never hardcoded or stored in plaintext. Encrypting the configuration file with KMS is an improvement over plaintext but still requires the application to manage decryption and doesn't inherently provide automatic rotation. Obtaining temporary credentials from STS is for AWS resources, not external SaaS providers. Systems Manager Parameter Store can store secrets, but Secrets Manager offers more robust secret management features, including built-in rotation for various services, making it the superior choice for this use case.