A developer is creating an Amazon DynamoDB table by using the AWS CLI The DynamoDB table must use server-side encryption with an AWS owned encryption…

Amazon DynamoDB encrypts all tables at rest by default using server-side encryption. The default encryption type is an AWS owned key. This key is owned and managed by the DynamoDB service for use in multiple AWS accounts. Users do not need to create or manage this key, and its use incurs no additional charge. When creating a DynamoDB table using the AWS CLI, omitting any server-side encryption specifications (--sse-specification) results in the table being created with this default encryption setting, thereby fulfilling the requirement.

A. This describes using a customer managed key, which is created and managed by the user, not the required AWS owned key.

B. This describes using an AWS managed key, which is a specific type of KMS key visible in the customer's account, distinct from the default AWS owned key.

C. Users cannot create an AWS owned key or provide its ARN. These keys are managed entirely by the AWS service and are not user-configurable.

1. AWS DynamoDB Developer Guide

"Amazon DynamoDB encryption at rest": This document states

"By default

all DynamoDB tables are encrypted under an AWS owned key. AWS owned keys are a collection of KMS keys that an AWS service owns and manages for use in multiple AWS accounts. AWS services can use AWS owned keys to protect your data."

2. AWS DynamoDB Developer Guide

"Managing encrypted tables in Amazon DynamoDB": Under the section "Creating an encrypted table

" the guide explains that if you do not specify encryption settings

DynamoDB enables encryption using the AWS owned key by default.

3. AWS CLI Command Reference

dynamodb create-table: The documentation for the create-table command shows the optional --sse-specification parameter. If this parameter is not included in the command

the table is created with the default encryption settings (an AWS owned key). The KMSMasterKeyId is only used when SSEType is set to KMS

which corresponds to AWS managed or customer managed keys.