Many Lambda functions in an application connect to a single Amazon RDS database. The database credentials must be stored securely, and when the credentials are updated the Lambda functions must be able to use the new credentials without changing code or configuration. Which solution meets these requirements?

Storing credentials in AWS Secrets Manager and retrieving them at runtime is the most secure and flexible solution. Secrets Manager allows for automatic rotation of credentials, and Lambda functions can fetch the latest version dynamically, ensuring they always use updated credentials without code changes. Injecting credentials into environment variables via containerDefinitions (an ECS/Fargate construct) is not directly applicable to standalone Lambda functions. While Secrets Manager can integrate with environment variables, this option describes a different deployment model. Using AWS Systems Manager Parameter Store with a trigger to pass credentials isn't a standard or efficient pattern for Lambda. Parameter Store is suitable for configuration, but Secrets Manager is purpose-built for secrets with features like automatic rotation. Referencing a Parameter Store SecureString in an environment variable would expose the secret as an environment variable, which is less secure than retrieving it directly from Secrets Manager at runtime, and doesn't inherently support automatic rotation or dynamic updates without redeployment.