During a security assessment, a hard-coded Amazon Redshift credential was found inside an AWS Glue job script. A data engineer must fix the vulnerability by storing the credentials securely. Which two actions should the engineer perform? (Choose two.)

Storing hard-coded credentials directly in code is a significant security vulnerability. AWS Secrets Manager is designed to securely store and manage sensitive information like database credentials. By saving the Redshift credentials in Secrets Manager, they are encrypted and can be rotated automatically, improving security posture. For the AWS Glue job to access these credentials, its associated IAM role must be granted explicit permissions to retrieve secrets from Secrets Manager. This adheres to the principle of least privilege, ensuring only authorized entities can access the secrets. Putting credentials into AWS Glue job parameters is better than hard-coding but still exposes them in the job definition and logs, making it less secure than Secrets Manager. Placing a configuration file with credentials in S3, or having the Glue job read from it, is also less secure than Secrets Manager, as S3 bucket policies and object encryption alone might not provide the same level of granular access control, rotation, and auditing capabilities.