A Glue pipeline connects to a relational source using a password embedded in job arguments and repository files. The team needs controlled secret retrieval and an appropriate rotation workflow. Which approach is best?

1. Move the same plaintext password into a more obscure repository filename.
2. Store the credential in Secrets Manager, grant the job role only the necessary retrieval and decryption access, and coordinate supported rotation with the database.
3. Rotate only the stored string without changing the source database credential.
4. Place the password in a publicly readable S3 object so all jobs can fetch it.