A. Update the default KMS key for Secrets Manager to allow only the Lambda function’s execution role to decrypt
B. Create a KMS customer managed key that trusts Secrets Manager and allows the Lambda function’s execution role to decrypt. Update Secrets Manager to use the new customer managed key
C. Create a KMS customer managed key that trusts Secrets Manager and allows the account’s root principal to decrypt. Update Secrets Manager to use the new customer managed key
D. Ensure that the Lambda function’s execution role has the KMS permissions scoped on the resource level. Configure the permissions so that the KMS key can encrypt the Secrets Manager secret
E. Remove all KMS permissions from the Lambda function’s execution role