kmsKeyArn

The ARN of the KMSlong (KMS) customer managed key that's used to encrypt the following resources:

• The function's environment variables.

• The function's Lambda SnapStart snapshots.

• When used with `SourceKMSKeyArn`, the unzipped version of the .zip deployment package that's used for function invocations. For more information, see Specifying a customer managed key for Lambda.

• The optimized version of the container image that's used for function invocations. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). For more information, see Function lifecycle. If you don't provide a customer managed key, Lambda uses an owned key or an .