Which AWS service lets customers create and control the encryption keys used by supported AWS services?
Show answer and explanation
Answer: A
KMS is the managed service where you generate, store, rotate, and set policies on encryption keys, and where supported services (S3, RDS, EBS, and many more) integrate to encrypt data under those keys. Controlling the keys means controlling who can ever decrypt the data.
The other services handle different security planes entirely: vulnerability scanning, DDoS mitigation, and content delivery.
Why the other options are wrong
- B. Inspector scans workloads for software vulnerabilities and unintended exposure; it does not create or manage encryption keys.
- C. Shield protects against DDoS attacks at the network and application layers.
- D. CloudFront caches and delivers content through its edge network; key generation is not among its functions.