An ECS application needs a database password at runtime. Security requires rotation and least-privilege retrieval rather than a secret baked into the image. Which solution is appropriate?

1. Put the password in a public S3 object with a hard-to-guess name.
2. Use an instance tag as a secret store and grant all accounts tag-read access.
3. Store the password in Secrets Manager, configure supported rotation, and scope the runtime retrieval role.
4. Put the password in the Dockerfile and rotate only the repository token.