Automated Credential Rotation with AWS Secrets Manager

The scenario requires three specific capabilities: restricting access to Amazon S3, encrypting data with AWS managed keys, and automatically rotating database credentials for an AWS Lambda function.

First, regarding encryption, the requirement specifies 'AWS managed keys'. In AWS terminology, this refers specifically to keys owned and managed by AWS services. Amazon S3 managed keys (SSE-S3) use keys that are fully managed by Amazon S3. While AWS KMS has a mode called 'AWS managed key' (distinct from 'Customer managed'), SSE-KMS generally implies using a Customer Managed Key (CMK) or introduces unnecessary complexity for simple S3 encryption when SSE-S3 is available and sufficient. More importantly, many certification questions distinguish between 'AWS managed' (SSE-S3 or S3-managed KMS alias) and 'Customer managed' (CMK). However, the most critical differentiator lies in the credential management.

Second, for credential rotation, AWS Secrets Manager is the native service designed specifically for storing secrets and provides built-in, out-of-the-box automatic rotation capabilities. You configure a rotation schedule within Secrets Manager, which triggers a Lambda function you define. This meets the requirement of automatic rotation seamlessly.

Third, for access control, IAM policies are the recommended best practice for controlling access to AWS resources, including S3 buckets accessed by Lambda functions. While S3 bucket policies can also restrict access, IAM policies are more granular and standard for identity-based access control for Lambda execution roles.

Option B correctly combines IAM policies for access, SSE-KMS (which can utilize AWS managed keys if not explicitly creating a CMK, though SSE-S3 is simpler), and crucially, uses AWS Secrets Manager for automated credential rotation. Option D uses Parameter Store, which does not have native automatic rotation; it requires manual implementation via scheduled Lambda functions, which is less robust than Secrets Manager's native feature. Option A stores credentials in environment variables, which cannot be rotated automatically without redeploying code. Option C uses ACLs (outdated/less secure) and Parameter Store (no native auto-rotation).

Therefore, Option B is the best fit because AWS Secrets Manager is the primary service for automated secret rotation.