You deploy an application to EC2 instances via CodeCommit and CodePipeline. The app requires sensitive database credentials on the instances. Which solutions store and retrieve those secrets most securely? (Choose two.)

AWS Secrets Manager and AWS Systems Manager Parameter Store (using SecureString) are both designed for securely storing and managing sensitive data like database credentials. Retrieving these secrets at application startup ensures the application has the necessary credentials without hardcoding them or storing them insecurely on the instance. Supplying them as environment variables is a common and secure practice for application configuration. Storing secrets in a Lambda function and invoking it is overly complex and not the intended use case for Lambda in this scenario. Encrypting volumes with AWS KMS protects data at rest but doesn't provide a secure, dynamic way to manage and inject secrets into an application at runtime, and the secrets would still be in a file on the instance. Storing secrets in a plaintext file in S3 is highly insecure and should never be done, as it exposes credentials directly.