An application already calls Systems Manager Parameter Store with GetParameter to read its plain configuration. A new database credential is stored in AWS Secrets Manager so it can use native rotation. The team wants the application to retrieve that rotated secret through the same Parameter Store GetParameter code path rather than adding the Secrets Manager SDK client. Which retrieval approach achieves this?
- ACall GetParameter with the name set to the aws reference secretsmanager path followed by the secret name, so Parameter Store returns the Secrets Manager value. Correct
- BCopy the secret value into a SecureString parameter and schedule a Lambda function to overwrite it whenever Secrets Manager rotates the credential.
- CCall GetParameter with the secret ARN as the parameter name, because Parameter Store resolves any ARN to its underlying value automatically.
- DEnable Parameter Store integration on the secret in Secrets Manager so the value is mirrored into a standard parameter of the same name.
Why A is correct: Parameter Store can proxy a Secrets Manager secret through the reserved aws reference secretsmanager name prefix, letting the existing GetParameter call return the rotated secret without a separate Secrets Manager client.
Why B is wrong: Duplicating the value into Parameter Store works but adds rotation glue code and a second copy that can drift, which the question asks to avoid by reading the secret directly.
Why C is wrong: Parameter Store does not resolve an arbitrary Secrets Manager ARN passed as a parameter name, so this call fails to return the secret value.
Why D is wrong: There is no toggle that mirrors a secret into a standard parameter, so this setting does not exist and would not expose the value through GetParameter.