A Lambda function must retrieve a rotating database credential. The developer wants to avoid hard-coding the password and avoid indefinite use of a stale cached value. Which approach is best?

1. Retrieve the secret through authorized SDK access and use a bounded refresh or rotation-aware cache.
2. Cache the first value forever and treat rotation as unrelated to client authentication.
3. Log the full secret after every retrieval to prove the correct value was read.
4. Read the secret once during development and bake that value into the deployment artifact.