An application stores objects in Amazon S3. The developer must enforce in-transit encryption for S3 access, and all objects containing personal data must be encrypted at rest with AWS KMS customer-managed keys that can be rotated on demand. Which combination of actions satisfies these requirements? (Choose two.)

To enforce in-transit encryption, an S3 bucket policy requiring aws:SecureTransport ensures all connections use HTTPS. This satisfies the requirement for encrypted connections. For at-rest encryption with customer-managed keys that can be rotated on demand, the application must encrypt objects client-side using an AWS KMS customer-managed key before uploading them to S3. This gives the developer full control over the encryption key and its rotation. An S3 bucket policy with a permissions boundary is incorrect; permissions boundaries control maximum permissions an IAM entity can have, not connection security. Creating an S3 bucket policy to enforce client-side encryption is incorrect; client-side encryption is performed by the client application, not enforced by a bucket policy. S3 Block Public Access settings prevent public access but do not enforce encrypted HTTPS connections for authorized users.