A township container task must retrieve database credentials at runtime. The credentials must be encrypted at rest with KMS and readable only by the task role. Which design best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Secrets Manager plus a task role is like a lockbox the container can open only with its badge—KMS keeps the secret encrypted at rest. Baking passwords into images or READMEs is how townships end up rotating credentials in a panic.
Full Explanation
Encrypting application secrets at rest with KMS-backed Secrets Manager (or SecureString parameters) and retrieving them via a least-privilege task/execution role is the standard secure pattern. Embedding plaintext secrets in images or public files, or disabling database auth, fails credential protection requirements in Task 1.3.