KMS Envelope Encryption in Lambda: Generate Data Keys Once, Encrypt Without Repeated KMS Calls
Use KMS GenerateDataKey to encrypt customer data locally in Lambda, store the encrypted data key with the ciphertext, and avoid per-record KMS calls. Includes a working Python example and verification steps.