How would you answer an interview scenario involving secrets management in Cloud Security?

An application currently reads a database password from an environment variable populated manually. Describe a safer cloud-native approach.