A company runs a web application that stores sensitive data in an Amazon DynamoDB table. The company requires end-to-end data protection and the ability to detect any unauthorized modifications. Which solution meets these requirements?

The DynamoDB Encryption Client provides client-side encryption, ensuring data is encrypted before it leaves the application and is stored in DynamoDB. This achieves end-to-end data protection. Additionally, the client can cryptographically sign table items, allowing for the detection of any unauthorized modifications to the data, thus meeting both requirements. Using an AWS KMS customer managed key to encrypt data at rest only protects data stored in DynamoDB, not in transit or before it reaches the service. AWS Private Certificate Authority (AWS Private CA) is for issuing and managing private certificates, primarily for securing communication (data in transit), not for end-to-end data protection or integrity of stored data. The AWS Encryption SDK is a general-purpose client-side encryption library, but the DynamoDB Encryption Client is specifically designed and optimized for DynamoDB, offering integrated signing capabilities tailored for table items.