A CloudOps engineer is designing a solution for an Amazon RDS for PostgreSQL DB instance.

AWS Secrets Manager is designed to securely store and automatically rotate database credentials. It integrates natively with Amazon RDS and supports scheduled credential rotation without application changes.

RDS Proxy manages database connections by pooling and reusing connections, which is critical for write-intensive workloads with sudden spikes in client connections. It improves scalability and reduces database resource exhaustion.

KMS rotates encryption keys, not database credentials. Read replicas do not help with write scaling or connection spikes.

Therefore, Secrets Manager combined with RDS Proxy is the correct solution.