A company runs a serverless website with millions of objects in an Amazon S3 bucket that is the origin for an Amazon CloudFront distribution. The bucket had no encryption set before the objects were uploaded. A solutions architect must enable encryption for all existing objects and for all future objects with the LEAST amount of effort. Which solution meets the requirement?

Enabling default encryption on the existing S3 bucket ensures all future objects are encrypted. For existing unencrypted objects, S3 Batch Operations with the CopyObject API call is the most efficient method. Copying an object to itself, even within the same bucket, triggers the default encryption settings. S3 Inventory helps identify all unencrypted objects to include in the Batch Operations job. Creating a new bucket and re-uploading (Option A) is more effort and incurs additional data transfer costs. Changing to SSE-KMS and enabling versioning (Option C) does not encrypt existing objects; versioning is unrelated to encrypting existing objects. Manually modifying each object (Option D) is impractical for millions of objects.