A company needs to create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster using a managed node group backed by Amazon Elastic Block Store (Amazon EBS) volumes. The company must encrypt all data at rest using a customer managed key in AWS Key Management Service (AWS KMS). Which combination of actions will meet this requirement with the LEAST operational overhead? (Choose two.)

Enabling EBS encryption by default in the AWS Region and selecting the customer managed key (CMK) ensures that all newly created EBS volumes, including those provisioned for EKS managed node groups, are automatically encrypted with the specified CMK. This is the most operationally efficient way to meet the encryption requirement for EBS volumes. Creating an IAM role with permissions to the CMK and associating it with the EKS cluster (specifically the EKS node instance profile or service account) is crucial. This grants the underlying EC2 instances and EKS components the necessary authorization to use the CMK for encryption and decryption operations, allowing the cluster to function correctly with encrypted volumes. Using a Kubernetes plugin or storing the CMK as a Kubernetes secret would increase operational overhead and complexity, as these methods require manual configuration within the cluster and are not the native AWS way to manage EBS encryption. Manually locating and encrypting EBS volumes after creation is inefficient and prone to errors, especially in dynamic environments like EKS.