An application connects to an RDS database using a password stored in a repository. The team must move the credential to a managed secret and rotate it automatically. What is the most appropriate operational approach?

1. Store the credential in Secrets Manager, configure supported automatic rotation, and allow the application role to retrieve the secret securely.
2. Encrypt the repository password with KMS and continue distributing the same long-lived credential without a rotation workflow.
3. Rename the repository file once per month without changing the database credential.
4. Move the password to a protected secret but rotate only the stored value without updating the database password.