A Lambda function that runs on a schedule must authenticate to a third-party system with an API key. The API key must remain encrypted at rest. Which approach meets this requirement?

Storing the API key in the Lambda function's environment variables and encrypting it with a customer-managed AWS KMS key is the most secure and recommended approach. Lambda environment variables are encrypted at rest by default using an AWS-managed key, but using a customer-managed key provides additional control and auditability. This method ensures the key is encrypted at rest and only decrypted when the Lambda function executes, minimizing exposure. Prompting a user for a password on the first run is impractical for a scheduled function and doesn't encrypt the key at rest. Hard-coding the API key is a severe security vulnerability, exposing the key in source control and making rotation difficult. While HTTPS is crucial for secure communication, using Lambda@Edge or HTTPS alone does not address the requirement of encrypting the API key at rest.