A developer needs to use Amazon DynamoDB to store customer orders.

Requirement Summary:

Storecustomer ordersin DynamoDB

Must encrypt data at rest

Company wants to use akey it generates(i.e., customer managed key)

Evaluate Options:

A. Set encryption to None, manually encrypt/decrypt in code

❌Overhead and error-prone

Alsonon-compliantwith AWS encryption best practices

✅B. Use customer managed KMS key

✅Exactly meets the requirement: customer generates and controls the key

During table creation, you can specify aKMS CMK ARN

C. Default encryption + kms:Encrypt in SDK

❌Misunderstanding: DynamoDB handles encryptionautomatically

You don’t need to call kms:Encrypt manually in SDK

D. Use AWS managed key

❌Does not meet the requirement of usingcustom company-generated key

DynamoDB encryption:https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

KMS customer managed keys:https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk