How do you manage secrets in serverless applications?

Managing secrets in serverless applications requires avoiding hardcoded credentials and environment variable plaintext. Best approaches: (1) AWS Secrets Manager — stores, rotates, and audits secrets (database passwords, API keys). Lambda retrieves secrets via SDK at startup: const secret = await secretsmanager.getSecretValue({ SecretId: 'prod/db/password' }).promise(). Cache the value in module scope; (2) AWS Systems Manager Parameter Store — cheaper than Secrets Manager for non-rotating secrets (free for standard, paid for advanced). Use SecureString type for encrypted storage; (3) Lambda environment variables with KMS encryption — encrypt environment variables with a KMS key; Lambda decrypts automatically. Simpler but rotation requires redeployment; (4) IAM roles — for AWS service credentials, never use access keys. Grant Lambda function's IAM role the necessary permissions — IAM handles credential rotation automatically. Best practice: combine IAM for AWS resources + Secrets Manager for third-party credentials + Parameter Store for configuration.