The city requires customer-controlled keys and audit of key use for a DynamoDB table of sealed case indexes. Do AWS owned keys meet that bar?
Select an answer to reveal the explanation.
Short Explanation
AWS owned keys are the default hotel safe—AWS holds the combination. A city that wants its own tumblers and CloudTrail key-use receipts needs a customer managed CMK on the DynamoDB table. VPC endpoints do not replace encryption key ownership.
Full Explanation
DynamoDB encrypts tables at rest; AWS owned keys minimize customer key management but do not give the city CMK-style key-policy control or the same KMS audit story. Customer managed keys (SSE-KMS) align with requirements for customer key control and CloudTrail-visible KMS API use. DynamoDB does support CMKs; disabling encryption is incorrect.