A developer is writing an application in AWS Lambda. To simplify testing and deployments, the developer needs the database connection string to be easily changed without modifying the Lambda code. How

AWS Secrets Manager stores, rotates, and manages access to secrets such as database credentials and connection strings. Lambda functions can retrieve the secret value at runtime via the Secrets Manager API using the function's IAM role, keeping sensitive configuration out of the code and enabling changes without redeployment or code modification.

IAM user accounts are for authentication and authorization principals, not for storing configuration data or secrets; there is no mechanism to store a connection string in an IAM user account.

AWS KMS is a key management service used for cryptographic operations and key storage; it is not designed to store arbitrary configuration values or connection strings.

Lambda layers package and share code libraries or dependencies across functions; they are deployed as immutable ZIP archives and are not suitable for storing dynamic configuration values that need to change without code redeployment.