A developer is building a highly secure healthcare application using serverless components. This application requires writing temporary data to /tmp storage on an AWS Lambda function.
How should the developer encrypt this data?
A.
Enable Amazon EBS volume encryption with an AWS KMS key in the Lambda function configuration so that all storage attached to the Lambda function is encrypted.
B.
Set up the Lambda function with a role and key policy to access an AWS KMS key. Use the key to generate a data key used to encrypt all data prior to writing to /tmp storage.
C.
Use OpenSSL to generate a symmetric encryption key on Lambda startup. Use this key to encrypt the data prior to writing to /tmp.
D.
Use an on-premises hardware security module (HSM) to generate keys, where the Lambda function requests a data key from the HSM and uses that to encrypt data on all requests to the function.
A) Eliminated - AWS Lambda does not use Amazon EBS volumes for its temporary /tmp storage.
C) Eliminated - OpenSSL could theoretically generate a symmetric key, this approach is less secure and more error-prone compared to using AWS KMS
D) Eliminated - Using an on-premises HSM adds unnecessary complexity and latency to a serverless application
AWS Key Management Service (KMS) provides secure management of encryption keys. The Lambda function can use a KMS key to generate data keys for encrypting and decrypting data. The Lambda function would require appropriate permissions to access the KMS key. This approach provides a high level of security, which is essential for a healthcare application.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
sumanshu
4 months agoalbert_kuo
7 months, 1 week ago65703c1
11 months, 1 week agoSerialiDr
1 year, 3 months agoMilan61
1 year, 6 months agoYuxing_Li
1 year, 8 months agoabdelbz16
1 year, 12 months agoMrTee
2 years ago