A health insurer stores PII in an Amazon S3 bucket and currently uses server-side encryption with S3-managed keys (SSE-S3). A new requirement mandates that all existing and future objects in the bucket be encrypted with keys managed by the company’s security team (customer-managed keys). The S3 bucket does not have versioning enabled. Which approach satisfies this requirement?

The correct option addresses all requirements: changing default encryption to SSE-KMS ensures new objects use customer-managed keys (via KMS). The bucket policy denying unencrypted PutObject requests enforces this for all uploads. Re-uploading existing objects is necessary because changing default encryption only applies to new uploads, not existing unencrypted objects. The first incorrect option incorrectly states "SSE-S3 using a customer-managed key"; SSE-S3 uses S3-managed keys, not customer-managed. The third incorrect option suggests encrypting on GetObject, which is not how S3 encryption works, and doesn't specify customer-managed keys. The fourth incorrect option mentions "AES-256 with a customer-managed key," which is ambiguous and doesn't explicitly refer to AWS KMS for customer-managed keys, which is the standard AWS service for this.