You are designing for an RDS for PostgreSQL instance whose database credentials must be rotated monthly. Client applications generate write-heavy traffic and have bursts of many connections. Which combination best satisfies credential rotation and handling connection spikes?

The correct option addresses both requirements effectively. AWS Secrets Manager is the service designed for automatic rotation of database credentials, including those for RDS, ensuring monthly rotation as required. RDS Proxy is specifically built to manage connection surges, reduce connection overhead, and improve application resilience for RDS databases, making it ideal for handling bursts of many connections. Incorrect options: Enabling automatic key rotation in AWS KMS for the database only rotates the encryption key for the underlying storage, not the database credentials. While RDS read replicas can absorb read traffic, they do not help with write-heavy traffic or manage the overhead of many connections to the primary instance. RDS Proxy is better suited for connection management.