A company is deploying a new application using AWS CloudFormation. They need to ensure that sensitive parameters, such as database passwords, are not hardcoded in the templates and are rotated automatically every 30 days. Which THREE actions should they take? (Select THREE)

Store the passwords in AWS Systems Manager Parameter Store as SecureString.

Store the passwords in AWS Secrets Manager.

Use CloudFormation parameters with NoEcho set to true to pass passwords during stack creation.

Configure an AWS Lambda function to handle the rotation logic for Secrets Manager.

Hardcode the passwords in a private S3 bucket and reference them in CloudFormation.

Use dynamic references in the CloudFormation template to retrieve the secrets from Secrets Manager.

Use AWS KMS to rotate the passwords.