Which AWS service can be used to safeguard sensitive data by managing encryption keys?

AWS Key Management Service (KMS) is specifically designed to create and manage cryptographic keys for your applications and control their use across a wide range of AWS services and in your applications. By using AWS KMS, you can ensure that sensitive data is encrypted appropriately, and you have full control over who can access and manage these encryption keys.

KMS simplifies the process of key management by allowing you to easily create, rotate, disable, and delete keys as needed, adhering to both security best practices and compliance requirements. It also integrates seamlessly with a variety of other AWS services for encryption, enabling organizations to safeguard sensitive information such as data at rest and data in transit effectively.

In contrast, AWS Shield is focused on providing protection against Distributed Denial of Service (DDoS) attacks, AWS Config is used for resource configuration compliance and auditing, and AWS WAF (Web Application Firewall) offers protection from web exploits but does not manage encryption keys. Therefore, AWS KMS is the most appropriate service for safeguarding sensitive data through encryption key management.