Security model for Lambda SnapStart
Lambda SnapStart supports encryption at rest. Lambda encrypts snapshots with an Amazon KMS key. By default,
Lambda uses an Amazon managed key. If this default behavior suits your workflow, then you don't need to set up
anything else. Otherwise, you can use the --kms-key-arn
option in the create-function
When you delete a SnapStart function or function version, all Invoke
requests to that function or function version fail. Lambda removes all resources associated with deleted snapshots in compliance with the General Data Protection Regulation (GDPR).