A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext. The developer needs to secure…

KMS encrypts the configuration file on disk, but the decrypted credentials are still read into memory from a file at runtime; this does not support automatic credential rotation and still requires distributing and managing the encrypted file.

AWS STS issues temporary credentials for AWS IAM principals, not for authenticating to external third-party SaaS vendors; STS cannot generate or rotate external API keys.

AWS Secrets Manager stores credentials encrypted using AWS KMS, retrieves them at runtime via SDK calls, and supports automatic rotation on a configurable schedule (e.g., quarterly). The application is updated to call Secrets Manager at runtime instead of reading a plaintext config file, ensuring credentials are never stored in code or on disk and are automatically refreshed.

AWS Systems Manager Parameter Store supports storing secrets but does not have native built-in automatic rotation functionality for third-party credentials the way Secrets Manager does; rotation must be implemented manually with a Lambda function.