Using AWS CloudFormation to deploy a two-tier app with Amazon RDS, the company needs the RDS password to be randomly generated during deployment and rotated automatically without changing the application. What is the most operationally efficient solution?

AWS Secrets Manager is the most operationally efficient solution because it can automatically generate and rotate database credentials, including for Amazon RDS, without requiring application changes. It integrates directly with CloudFormation for deployment and handles the complexity of rotation schedules and secure storage. Lambda-backed custom resources could generate and rotate the password, but this requires significant custom development and maintenance, making it less operationally efficient than Secrets Manager's built-in functionality. AWS Systems Manager Parameter Store SecureString can store secrets securely but lacks inherent automatic rotation capabilities for RDS. A cron job on the application host is insecure, complex to manage at scale, and doesn't integrate well with CloudFormation or provide automatic rotation for RDS.