A company customizes models in Amazon Bedrock and wants the artifacts produced by model customization jobs encrypted with a company-managed encryption key. Which AWS service provides customer-managed keys for this purpose?

AWS Key Management Service (AWS KMS) allows you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications. For Amazon Bedrock, KMS can be used to encrypt the artifacts generated during model customization jobs with customer-managed keys (CMKs), ensuring that your sensitive data remains protected under your control. Amazon Inspector is a vulnerability management service that continuously scans your AWS workloads for software vulnerabilities and unintended network exposure. Amazon Macie is a data security service that uses machine learning and pattern matching to discover and protect sensitive data in AWS. AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. While these services are security-related, they do not provide customer-managed encryption keys for data at rest in the way KMS does for Bedrock customization artifacts.