A company stores training data as a .

AWS Key Management Service (AWS KMS) is the recommended service for encryption and key access control. By creating a customer-managed KMS key, the company can define granular IAM policies that control which applications and roles can use the key.

The AWS Encryption CLI integrates directly with KMS and enables client-side encryption of files before storing them in Amazon S3. This approach ensures data is encrypted at rest and that only authorized principals can decrypt it.

SSH keys and API keys are not designed for data encryption. IAM roles alone do not create or manage encryption keys—they only grant permissions.

AWS documentation explicitly states that KMS customer-managed keys provide centralized key management, auditing, and access control.

Therefore, Option D is the correct and AWS-aligned solution.