A company exposes read access to objects in an S3 bucket for various customers, using IAM permissions so each customer can only access their files. A regulation mandates enforcing encryption in transit for S3 interactions. Which change enforces encryption in transit for the bucket?

The correct option is to add a bucket policy that denies S3 actions when the aws:SecureTransport condition is false. This condition key specifically checks if the request was made using SSL/TLS, effectively enforcing encryption in transit for all interactions with the S3 bucket. If a request is not encrypted, the policy will deny it. The other options are incorrect because: Denying S3 actions when s3:x-amz-acl equals public-read addresses object ACLs, not encryption in transit. Requiring the use of the AWS SDK does not inherently enforce encryption in transit; SDKs can be configured to use HTTP or HTTPS. Allowing S3 actions only when s3:x-amz-acl equals bucket-owner-read relates to object ownership and access control, not the transport layer security.