The city uses AWS Key Management Service (AWS KMS) for encryption. Who is responsible for key policy and encryption configuration choices that protect municipal data?
Select an answer to reveal the explanation.
Short Explanation
AWS builds the lock factory; the city still chooses which locks go on which doors and who holds the keys. KMS is the service; key policies and encryption settings for municipal data are customer choices. Providing the tool does not make AWS the author of your data-protection decisions.
Full Explanation
When the city uses AWS Key Management Service (AWS KMS), AWS provides the managed key management service, but the city remains responsible for how encryption and key policies are configured to protect municipal data. Providing the lock factory does not make AWS the author of every key policy or encryption setting for customer content. Amazon CloudFront does not automatically own all KMS key policies for every workload. Encryption configuration is not optional theater that customers may forever ignore while still claiming strong data protection. Correct reasoning separates service availability from configuration accountability: KMS is the tool; key administrators, key policies, grants, and which data keys protect which datasets are customer decisions aligned to classification and compliance needs. Distractors fail by assigning all policy choices solely to AWS, by inventing CloudFront ownership of KMS policies, or by declaring encryption configuration never a customer duty. Exam caveat: "AWS offers encryption" is not the same statement as "AWS chose your key policy." Operational check: inventory CMKs or appropriate key types, review key policies for least privilege, confirm encryption is enabled on sensitive stores (for example S3, EBS, RDS as designed), and test that unauthorized principals cannot use keys to decrypt civic records.