A company will move data to an Amazon S3 bucket. The data must be encrypted at rest in the S3 bucket, and the encryption key must be automatically rotated every year. Which solution meets these requirements with the LEAST operational overhead?

The correct answer leverages SSE-S3, which encrypts objects with keys managed by AWS. These keys are automatically rotated by AWS annually, fulfilling both the encryption and automatic annual rotation requirements with the least operational overhead. AWS handles all key management. The option to create an AWS KMS customer managed key with automatic key rotation is viable but incurs more operational overhead than SSE-S3 because you manage the KMS key, even if rotation is automatic. Manually rotating a KMS key every year significantly increases operational overhead, failing the "least operational overhead" requirement. Encrypting data with customer key material before moving it to S3, then importing that material into KMS, adds complexity and operational overhead for key management outside of AWS's fully managed solutions.