A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes.The company must ensure that all data is encrypted at rest by using AWS Key Management Service (AWS KMS).The company must be able to control rotation of the encryption keys.
Which solution will meet these requirements with the LEAST operational overhead?
Create a customer managed key. Use the key to encrypt the EBS volumes.
Use an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key rotation.
Create an external KMS key with imported key material. Use the key to encrypt the EBS volumes.
Use an AWS owned key to encrypt the EBS volumes.
I systematize that the answer is:
Create a customer managed key. Use the key to encrypt the EBS volumes.