A Lambda that connects to a legacy host must decrypt a sealed configuration blob using a customer managed KMS key before startup. What must the function do?
Select an answer to reveal the explanation.
Short Explanation
The Lambda asks KMS to open the sealed config—Decrypt or envelope data keys—with kms permissions on that CMK. Do not zip the raw key material into the package. KMS is very much callable from Lambda.
Full Explanation
Applications decrypt sealed material by calling AWS KMS (Decrypt or GenerateDataKey/envelope patterns) under an execution role that permits use of the target CMK. Embedding key material in the deployment package, publishing plaintext config publicly, or claiming Lambda cannot call KMS are incorrect and insecure.