AWS Key Management Service (KMS) provides control over the encryption keys, including key creation, rotation, and usage policies. It supports key rotation, enabling the organization to adhere to security best practices. Using KMS customer managed keys (CMKs), the organization can define rotation policies including automatic rotation of the keys every year. S3 supports server-side encryption with KMS-managed keys (SSE-KMS) for encrypting data at rest. AWS CloudHSM does provide control over encryption keys but typically is used when organizations require dedicated hardware security modules within their AWS environment. Amazon Macie is a data security service focused on data discovery and protection rather than key management. While AWS Certificate Manager manages SSL/TLS certificates, it does not manage keys for data at rest encryption.