A company needs to securely transfer data from its Salesforce SaaS account to Amazon S3. The data must be encrypted at rest with AWS Key Management Service (AWS KMS) customer managed keys (CMKs) and encrypted in transit. The Salesforce account has API access enabled. Which solution will meet these requirements?

Amazon AppFlow is a fully managed integration service that enables secure data transfer between SaaS applications like Salesforce and AWS services such as Amazon S3. It natively supports encryption at rest with AWS KMS CMKs and encryption in transit, directly meeting the stated requirements. AppFlow simplifies the process by providing pre-built connectors and handling the underlying infrastructure. AWS Lambda functions and AWS Step Functions workflows could be used, but they would require significant custom development to handle the Salesforce API integration, data mapping, error handling, and encryption, making them less efficient and more complex than AppFlow for this specific use case. Creating a custom connector for Salesforce is also a development-heavy approach that AppFlow aims to abstract away.