A company's policy requires that all API keys be encrypted and stored separately from source code in a centralized security account. This security account is managed by the company's security team…

CodeCommit is a source code repository, not a secrets management service; storing API keys there, even encrypted, reintroduces them into a code-accessible context and does not meet the requirement of storing secrets separately from source code.

An S3 bucket can store encrypted files but lacks native secret versioning, automatic rotation, fine-grained access auditing, and the semantic access controls that purpose-built secrets management requires.

Creating a secret in AWS Secrets Manager in the centralized security account encrypts the API key using a KMS CMK, provides fine-grained IAM cross-account access control, enables automatic rotation, and allows the Lambda function in the DevOps account to retrieve the secret at runtime via an IAM role, keeping the key entirely out of the codebase and separate from the source code repository.

Lambda encrypted environment variables are scoped to the specific Lambda function in the DevOps account and are accessible to anyone with Lambda configuration access in that account, keeping the secret coupled to the source code environment rather than centralized in the security account.