You are developing an application that is using AWS Lambda. A Lambda function is placed in a private subnet which does not have access to internet. This Lambda function will receive bank account information as a JSON object. This JSON is about 7 Kb of size. You need to encrypt this information and then save it to DynamoDB. Which approach could satisfy this requirement?

Answer options:

A.Create a VPC Endpoint in the Lambda VPC for the KMS Service. Generate a new Customer Master Key. Encrypt the JSON data using KMS Envelope Encryption. Upload the encrypted data to DynamoDB.B.Generate a new Customer Master Key. Encrypt the JSON data using KMS Envelope Encryption. Upload the encrypted data to DynamoDB.C.Create a VPC Endpoint in the Lambda VPC for the KMS Service. Generate a new Customer Master Key. Encrypt the JSON data with the encrypt() KMS method using the CMS previously generated. Upload the encrypted data to DynamoDB.D.Generate a new Customer Master Key. Encrypt the JSON data with the encrypt() KMS method using the CMS previously generated. Upload the encrypted data to DynamoDB.

Correct Answer: A
Option A is CORRECT because the Lambda function is placed in a subnet with no internet access, so it will need the KMS VPC endpoint in order to work with KMS. Because the JSON object is bigger than 4kb you will need to encrypt using Envelope Encryption. More details: https://lobster1234.github.io/2017/09/29/aws-kms-envelope-encryption/
OptionB is incorrect because the Lambda Function needs internet access in order to communicate with KMS. More details: https://aws.amazon.com/blogs/security/how-to-connect-directly-to-aws-key-management-service-from-amazon-vpc-by-using-an-aws-privatelink-endpoint/
Option C is incorrect because the JSON object is 7Kb of size and the maximum size allowed with the KMS encryption() method is 4kb. More details: https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html
Option D is incorrect because the Lambda Function needs internet access in order to communicate with KMS. More details: https://aws.amazon.com/blogs/security/how-to-connect-directly-to-aws-key-management-service-from-amazon-vpc-by-using-an-aws-privatelink-endpoint/