A company uses AWS Organizations to manage several accounts and processes a large volume of sensitive data. Data is stored in Amazon S3 and Amazon DynamoDB, and is accessed by AWS Lambda functions and containerized services on Amazon EKS on AWS Fargate. The company must encrypt all data at rest and enforce least privilege for data access. The company has created a customer managed AWS KMS key. What should the company do next to meet these requirements?

The correct option enforces encryption and least privilege. The key policy restricts kms:Decrypt to the services that legitimately need to access the encrypted data (S3, DynamoDB, Lambda, EKS), ensuring least privilege for the KMS key. The Service Control Policy (SCP) prevents the creation of unencrypted S3 buckets and DynamoDB tables, mandating encryption at rest across the organization. The first incorrect option is too restrictive; Lambda and EKS also need kms:Decrypt permissions to process the data. The second incorrect option uses an IAM policy to deny kms:Decrypt, which is counterproductive, and relies on alerts rather than preventative controls. The fourth incorrect option correctly defines the key policy but uses an AWS Config rule for alerting instead of an SCP for preventative enforcement, which is less robust for mandating encryption.