A team is building a serverless app and must store an external API key as part of an AWS Lambda configuration. The team requires full control over the AWS KMS keys that will encrypt the API key and wants the key material accessible only to authorized principals. Which option satisfies these requirements?

Storing the API key in Lambda environment variables encrypted with a customer-managed KMS key (CMK) meets the requirements. Lambda environment variables can be encrypted at rest using a specified KMS key. Using a CMK gives the team full control over the key policy, allowing them to define exactly which principals can decrypt the key material. This ensures the key is accessible only to authorized principals. Incorrect options: Systems Manager Parameter Store with a default AWS-managed KMS key does not provide the team with full control over the KMS key. Storing the API key in the application's source code repository is a security anti-pattern and highly discouraged, regardless of encryption. Storing the API key in DynamoDB with an AWS-managed KMS key does not give the team full control over the encryption key, and environment variables are a more direct and common method for Lambda secrets.