An application retrieves a database username and password for Amazon RDS for PostgreSQL. Security policy requires automatically changing the password every 30 days and allowing the application to retrieve the current value without a new deployment. Which solution has the least custom credential-management work?

1. Store the password in an encrypted S3 object and use an S3 lifecycle rule to rotate it.
2. Use a Systems Manager Parameter Store SecureString and assume encryption automatically rotates the database password.
3. Store the credentials in Secrets Manager, configure supported automatic rotation, and let the application retrieve the secret with an IAM role.
4. Place the password in EC2 user data and replace instances every 30 days.