A Lambda function needs an API secret in configuration. The team wants access limited to the workload and no secret in source control. Which approach is appropriate?

1. Put the secret in a public application-settings endpoint.
2. Add the secret to an ordinary resource tag and allow all users to list tags.
3. Store the secret in a managed secret service and grant a narrowly scoped execution-role retrieval permission.
4. Commit the secret to Git and remove it only from the latest file revision.