A developer is building a highly secure healthcare application using serverless components. This application requires writing temporary data to /tmp storage on an AWS Lambda function. How should the developer encrypt this data?
A) Enable Amazon EBS volume encryption with an AWS KMS CMK in the Lambda function configuration so that all storage attached to the Lambda function is encrypted.
B) Set up the Lambda function with a role and key policy to access an AWS KMS CMK. Use the CMK to generate a data key used to encrypt all data prior to writing to /tmp storage.
C) Use OpenSSL to generate a symmetric encryption key on Lambda startup. Use this key to encrypt the data prior to writing to /tmp storage.
D) Use an on-premises hardware security module (HSM) to generate keys, where the Lambda function requests a data key from the HSM and uses that to encrypt data on all requests to the function.

Question

Quizplus · Accepted Answer

AWS Lambda functions can use AWS KMS to generate data keys for encrypting data. By setting up the Lambda function with the appropriate role and key policy, the function can use a KMS CMK to generate a data key, which can then be used to encrypt data before writing it to the /tmp storage. This approach ensures that the data is encrypted using AWS's managed key service, which is secure and scalable.

A Developer Is Building a Highly Secure Healthcare Application Using