This is a dedicated watch page for a single video.
The security team at CloudSync Corp is reviewing the architecture of a Lambda function that's part of their data aggregation pipeline. The Lambda function pulls data from an Aurora database within the same VPC, currently using environment variables for database credentials, and then publishes aggregated data to an S3 bucket with SSE-KMS encryption, with a strict requirement to avoid internet transit for this data. What should the solutions architect recommend to meet these requirements, especially regarding minimizing the impact of potential credential compromise?