A developer is building a highly secure, serverless healthcare application. The application needs to write temporary data to the /tmp directory of an AWS Lambda function. Which approach should the developer use to encrypt that temporary data?

The correct approach is to use AWS Key Management Service (KMS) to encrypt the temporary data. AWS Lambda's /tmp directory is ephemeral storage, meaning its contents are lost after the function invocation. To encrypt data written to /tmp, the encryption must happen before the data is written. A KMS key can be used to generate a data key, which then encrypts the data locally within the Lambda function's execution environment. The Lambda function's IAM role needs permissions to use the KMS key, and the KMS key policy must allow the role to perform cryptographic operations. Incorrect options: EBS volume encryption is not applicable here because Lambda's /tmp directory is not backed by an EBS volume. Generating a symmetric key with OpenSSL at startup is less secure and harder to manage than using a managed service like KMS. It also introduces the challenge of securely storing and rotating that key. Using an on-premises HSM introduces latency and complexity, and is generally not suitable for serverless functions that require fast, scalable, and fully managed encryption solutions.