An application stores objects in an Amazon S3 bucket using the PutObject API. The objects must be encrypted at rest using server-side encryption with Amazon S3–managed keys (SSE-S3). Which approach satisfies this requirement?

The correct approach is to include the x-amz-server-side-encryption header when calling the PutObject API. This header explicitly tells S3 to encrypt the object using SSE-S3. Alternatively, you could configure a default encryption policy on the S3 bucket to enforce SSE-S3 for all new objects. Creating an AWS KMS key and assigning it to the S3 bucket would enable SSE-KMS, not SSE-S3. Sending the encryption key in the HTTP header with every request is for client-side encryption or SSE-C, not SSE-S3. Using TLS encrypts data in transit, not at rest, and is a separate security measure from server-side encryption.