A company has a custom application with embedded credentials that retrieves information from a database in an Amazon RDS for MySQL DB cluster. The company needs to make the application more secure…

AWS Key Management Service (KMS) is used for creating and managing cryptographic keys to encrypt data. While Secrets Manager uses KMS for encryption, KMS itself is not the service for storing and managing the credentials directly.

Storing credentials in encrypted local storage, while an improvement over plaintext, still requires the company to manage encryption, decryption, and rotation manually, which contradicts the 'minimal programming effort' and 'more secure' requirements compared to a fully managed service.

AWS Secrets Manager is specifically designed for storing and retrieving sensitive information like database credentials. It can automatically rotate credentials for Amazon RDS for MySQL databases, significantly enhancing security with minimal changes to the application logic, which simply needs to retrieve the secret from Secrets Manager instead of having it embedded.

AWS Systems Manager Parameter Store can store secrets, but AWS Secrets Manager offers more advanced features specifically for database credentials, such as automatic rotation for RDS databases, which aligns better with the requirement for 'minimal programming effort' to achieve a 'more secure' solution.