An application running on EC2 instances stores data in an S3 bucket. All data must be encrypted in transit. How can a developer ensure that all traffic to the S3 bucket is encrypted?

The aws:SecureTransport condition key in an S3 bucket policy explicitly enforces that all incoming requests to the bucket must use HTTPS (TLS) for encryption in transit. If a request comes in over unencrypted HTTP, the policy will deny it, ensuring all traffic is encrypted. Installing TLS certificates on EC2 instances encrypts traffic originating from the instances, but doesn't guarantee the S3 bucket will only accept encrypted traffic. A private VPC endpoint for S3 provides private connectivity but doesn't inherently enforce encryption in transit; it still relies on the client using HTTPS. Enabling SSE-KMS encrypts data at rest in S3, not in transit.