Kappa Labs needs to store 15 API keys for upstream partners. Keys must be encrypted with a customer-managed KMS key, retrieved individually, and versioned independently for rollback. Engineers attempted to use a SecureString StringList and encountered errors. What should they do?

The correct approach is to create one SecureString parameter per API key. This satisfies the requirement for individual retrieval and independent versioning. AWS Systems Manager Parameter Store's SecureString type, encrypted with a Customer Managed Key (CMK), meets the encryption and customer-managed key requirements. Using a hierarchical path allows for organized storage and easy retrieval of specific keys. Storing all keys in a single StringList SecureString or a single JSON array SecureString prevents individual versioning and retrieval, making rollbacks for a single key impossible without affecting others. AWS Secrets Manager is a valid option for secrets management, but the question specifically mentions SecureString and the issues encountered, implying a solution within Parameter Store. While Secrets Manager supports individual secrets, the prompt's context points to Parameter Store.