A payments startup stores database passwords and third-party API keys in Lambda environment variables with manual rotation causing outages. They need automatic rotation, fine-grained audit, and no code changes for retrieval. Which secrets design should the team adopt to manage credential rotation securely?

Secrets Manager is correct because it offers native automatic rotation via managed Lambda that creates, tests, and promotes new versions without outage, KMS encryption, detailed CloudTrail events per secret for fine-grained audit, and retrieval through the Secrets Manager Lambda extension or caching client with minimal change to function code, while VPC endpoints keep traffic private, solving manual handling and compliance needs together. The Parameter Store SecureString pattern fails on rotation because despite KMS protection, versioning, and extension-based retrieval with CloudTrail logging, it provides no built-in rotation scheduler or staged version testing, so teams must build and maintain custom automation that recreates the original outage risk. The private S3 with KMS versioning pattern fails on integration because despite strong encryption, bucket policies, and auditable access, it forces custom SDK download, decrypt, and cache logic inside the handler, violating the requirement for no code changes and adding latency. The pipeline-delivered environment file pattern fails on auditability because despite EventBridge scheduling that mimics rotation and automated delivery, dispersed file copies across artifacts and function config prevent per-secret attribution, instant revocation, and centralized logging. Exam caveat is to separate true staged rotation with validation from scheduled redeployment or version increment, which does not ensure atomic database credential switchover. Practical check is to enable rotation, verify AWSPENDING to AWSCURRENT promotion on a replica, confirm endpoint policy, and review CloudTrail GetSecretValue calls.