One option
25. Envelope encryption
During a design review, the team identifies this need: encrypt data keys with a key-encryption key. Which AWS service or concept is the most direct fit?