A company must provide customers with secure access to data. The company processes customer data and stores results in an Amazon S3 bucket. The data is subject to strict regulations and must be encrypted at rest. Each customer must be able to access only their own data from their AWS account, and company employees must not be able to access customer data. Which solution meets these requirements?

The correct solution uses AWS Key Management Service (KMS) keys for encryption and granular access control. Provisioning a separate KMS key for each customer ensures data isolation. Server-side encryption with KMS (SSE-KMS) encrypts data at rest in S3. The critical step is configuring each KMS key policy to explicitly deny decryption for all principals except the IAM role provided by that specific customer. This prevents company employees or other customers from decrypting another customer's data, meeting the strict access requirements. Incorrect options: ACM certificates are for securing network communication (TLS/SSL), not for encrypting data at rest or managing access to S3 objects. Client-side encryption would require customers to manage encryption keys, which is not implied by the problem. While an S3 bucket policy can control access to objects, placing the decryption denial solely in the S3 bucket policy might not be as robust as controlling it directly at the KMS key level. The KMS key policy is the authoritative source for who can use a specific key for cryptographic operations.