A containerized application runs on an Amazon EC2 instance and must download security certificates before it can communicate with other business applications. The company requires a highly secure solution to encrypt and decrypt the certificates in near real time, and it needs to store data in highly available storage after encryption. Which solution meets these requirements with the LEAST operational overhead?

The correct solution leverages AWS Key Management Service (KMS) for secure encryption and decryption, and Amazon S3 for highly available storage, minimizing operational overhead. KMS provides a managed service for creating and controlling encryption keys, allowing the EC2 instance's IAM role to perform cryptographic operations without managing encryption software. S3 offers durable, highly available, and scalable object storage. Incorrect options: AWS Secrets Manager is designed for managing secrets like database credentials, not for general-purpose encryption of large data or certificates themselves, and manual updates increase operational overhead. An AWS Lambda function using a Python cryptography library would require developing and maintaining custom encryption logic, increasing operational overhead compared to a managed service like KMS. Storing the function in S3 is not relevant to the encryption mechanism itself. Storing encrypted data on Amazon EBS volumes would tie the data to a specific EC2 instance, reducing availability and scalability compared to S3, which is object storage designed for high availability and durability independently of compute instances.