AWS Key Management Service (AWS KMS) is the service that allows customers to create and manage encryption keys. It provides the ability to control the use of the key in cryptographic operations. By creating a Customer Managed Key (CMK) and defining the key policy to allow only the security team to manage and use the key, the compliance requirement can be met. S3 will use this CMK to encrypt data at rest. Other options like AWS Certificate Manager are primarily for managing SSL/TLS certificates, not encryption keys for data at rest, and Amazon S3 server-side encryption does not provide the fine-grained key management needed to comply with the requirement that only the security team can manage the keys.