A Lambda-backed civic chatbot needs a third-party API token. Which approach best matches foundational guidance on where to keep that secret?

Store the third-party API token for a Lambda-backed civic chatbot in AWS Secrets Manager rather than embedding it as plaintext in code or casual environment discussions. API tokens are keys to someone else's castle — do not leave them in source comments, public docs, or open security group description fields. Pasting the token into Lambda function code comments for easy edits leaks secrets into deployments and repos. Committing the token to a public documentation repo for onboarding broadcasts it. Putting the token in an open security group description abuses a network construct as a secret store. Distractors fail by placing secrets in code, docs, or security group metadata. Exam caveat: grant the Lambda execution role permission to read only that secret, consider rotation, and avoid logging secret values. Operational check: create the secret in Secrets Manager, update the function to retrieve at runtime, remove plaintext copies from code and tickets, restrict IAM read access, enable encryption with KMS, and audit GetSecretValue calls for unexpected principals. In practice, retrieve the chatbot token at cold start or per invoke from Secrets Manager, scrub logs for secret material, and rotate the third-party token when staff turnover hits the vendor account.