A security team must create cryptographic keys, control which IAM identities may use them, and have AWS handle the secure storage of the key material across several services. Which AWS service is purpose-built to manage these encryption keys centrally?
- AAmazon GuardDuty, which continuously analyses account logs with threat intelligence to detect suspicious or malicious activity early.
- BAWS Identity and Access Management, which signs in users and groups and grants permissions to call the various AWS service actions.
- CAWS Key Management Service, which creates and stores keys and controls which identities are allowed to use them for encryption. Correct
- DAmazon Macie, which discovers and classifies sensitive data held in Amazon S3 buckets so owners know where it lives.
Why A is wrong: GuardDuty is a threat-detection service that watches for malicious behaviour, so it monitors activity rather than creating or storing encryption keys.
Why B is wrong: IAM controls who can call AWS actions and is tempting because it manages access, but it does not create or store the cryptographic keys themselves.
Why C is correct: AWS KMS is the managed service for creating, storing, and governing access to cryptographic keys, and it integrates with many AWS services for encryption.
Why D is wrong: Macie finds and labels sensitive data such as personal records in S3, so it reports on data exposure rather than managing encryption keys.