A company is migrating an application to AWS and prefers fully managed services where possible. The application must store large important documents with these requirements: (1) very high durability and availability, (2) encryption at rest and in transit at all times, and (3) the company must manage and periodically rotate the encryption key. Which solution should the solutions architect recommend?

Amazon S3 is the most suitable choice because it is a fully managed service offering very high durability and availability, meeting the core requirements. Enforcing HTTPS ensures encryption in transit, and server-side encryption with AWS KMS via a bucket policy guarantees encryption at rest using customer-managed keys, which can be rotated. AWS Storage Gateway in file gateway mode stores data in S3 but adds an unnecessary layer of complexity and management overhead for a fully managed preference. Amazon DynamoDB is a NoSQL database, not designed for storing large documents directly. Deploying instances with Amazon EBS volumes requires managing EC2 instances, which goes against the preference for fully managed services.