A company is building a static-content website on Amazon S3 with Amazon CloudFront. Users must be able to upload and download large files. Company policy requires that all data be encrypted both in transit and at rest. Which combination of actions will satisfy the encryption requirements? (Choose three.)

Enabling S3 server-side encryption (SSE) for the S3 bucket ensures that all data stored at rest in S3 is encrypted, meeting the at-rest encryption requirement. Creating an S3 bucket policy that denies unencrypted requests forces all interactions with the S3 bucket to use HTTPS, thus encrypting data in transit directly to S3. Configuring CloudFront to redirect HTTP to HTTPS ensures that all user-facing traffic to the website is encrypted in transit from the user to CloudFront. Adding aws:SecureTransport: "true" to S3 ACLs is not a valid or effective way to enforce TLS. CloudFront itself does not store content at rest in a way that requires SSE-KMS for encryption at rest; its primary role is caching and content delivery. While RequireSSL is an option for S3 presigned URLs, the CloudFront redirect to HTTPS and the S3 bucket policy provide a more comprehensive solution for all traffic.