An application uses DocumentDB as its database. The application development team wants to implement automatic rotation of database credentials. How should the application team meet this requirement?

Answer options:

A.Store credentials in AWS Secrets Manager. Update the application to retrieve the credentials. Enable secret rotation.
B.Store credentials in System Manager Parameter Store. Update the application to retrieve the credentials. Enable secret rotation.
C.Store credentials in AWS KMS. Update the application to retrieve the credentials. Enable secret rotation.
D.Store credentials in AWS KMS. Update the application to retrieve the credentials. Create an AWS Lambda function to rotate the credentials. Create CloudWatch Alarm to trigger the Lambda function.

Answer: A
Option A is CORRECT because AWS Secrets Manager can be used to store and automatically rotate database credentials securely.
Option B is incorrect because the System Manager Parameter Store cannot automatically rotate stored parameters.
Option C is incorrect because AWS KMS is used for storing cryptographic encryption keys.
Option D is incorrect because AWS KMS is used for storing cryptographic encryption keys.
Reference:
https://aws.amazon.com/blogs/security/how-to-rotate-amazon-documentdb-and-amazon-redshift-credentials-in-aws-secrets-manager/