Which AWS service can be used to encrypt data at rest?

Explanations:

Amazon GuardDuty is used for threat detection and monitoring, not for data encryption.

AWS Shield is designed for DDoS protection, not data encryption.

AWS Security Hub provides security posture management but does not handle data encryption.

AWS Key Management Service (AWS KMS) is specifically used for data encryption at rest and key management.