A company stores call logs in S3 that include sensitive customer information. The objects must be encrypted using keys that only certain employees can access. Which solution provides the required protection with the least effort?

SSE-KMS is the correct choice because it integrates with AWS Key Management Service (KMS), allowing fine-grained control over encryption keys and their access through IAM policies. This directly addresses the requirement for only certain employees to access keys, providing both strong encryption and manageable access control with minimal operational overhead. SSE-C requires the customer to manage and provide encryption keys with each request, increasing operational complexity and potential for error compared to KMS. AWS CloudHSM offers the highest level of key control but involves significant setup and management effort, making it not the "least effort" solution for this scenario. SSE-S3 uses keys managed entirely by AWS, which does not allow for restricting key access to specific employees, failing to meet the core requirement.