A company must encrypt sensitive customer data stored in Amazon S3 and Amazon EBS volumes. They need centralized control over the cryptographic keys, including the ability to create, rotate, disable, and audit key usage. Which AWS service should they use?