Encrypting a function in KMS