Four Lambda functions connect to an Amazon RDS relational database. The security team requires the database password to be rotated automatically every 30 days. Which solution is the most secure way to meet this requirement?

Storing database credentials in AWS Secrets Manager and configuring automatic rotation every 30 days is the most secure solution. Secrets Manager is specifically designed for managing and rotating sensitive credentials, including database passwords, and integrates directly with RDS for seamless rotation. It handles the complexity of generating new passwords, updating the database, and updating the stored secret. Storing credentials in Lambda environment variables is insecure because they are not encrypted at rest by default and require manual redeployment, which is prone to errors and downtime. Systems Manager Parameter Store with SecureString offers encryption but lacks native automatic rotation for database credentials, requiring custom automation. Storing credentials in an S3 object, even with SSE-C, is not designed for credential management or automatic rotation, making it an unsuitable and less secure option.