Multiple Lambda functions consume messages from an SNS topic and write to an Amazon Aurora database. Company policy requires that all Lambdas use a single, securely encrypted database connection string. Which solution meets this requirement?

Storing database credentials in AWS Systems Manager Parameter Store as a SecureString parameter is the most secure and manageable solution. SecureString encrypts the parameter value using AWS KMS, ensuring the credentials are protected at rest and in transit. Lambda functions can retrieve these parameters at runtime, allowing for centralized management and rotation of credentials without redeploying code. IAM database authentication for Aurora is excellent for security but doesn't solve the problem of securely distributing a single connection string to multiple Lambdas. Storing credentials on an encrypted RDS instance is an anti-pattern; databases are for data, not credential storage for other services. Lambda environment variables, while encrypted with KMS, are tied to individual Lambda deployments, making centralized management and rotation difficult across multiple functions.