An S3 bucket contains sensitive data encrypted with a KMS key. Several other AWS accounts need permission to call GetObject on the bucket. How can you ensure that all requests to retrieve objects use encryption in transit?

The correct answer is to attach a resource-based bucket policy that denies access when the condition aws:SecureTransport is false. This policy directly enforces that all incoming requests to the S3 bucket must use HTTPS (TLS) for encryption in transit. S3 bucket policies are the appropriate mechanism for controlling access and enforcing conditions on the bucket itself. The option "Attach a resource-based bucket policy that allows access when the condition aws:SecureTransport is false" is incorrect because it would permit insecure transport, which is the opposite of the requirement. "Add a role policy in the other accounts that denies access when aws:SecureTransport is false" is incorrect because client-side policies cannot enforce server-side requirements for secure transport. The S3 bucket policy is needed to reject insecure requests. "Attach a resource-based policy to the KMS key that denies access when aws:SecureTransport is false" is incorrect because the aws:SecureTransport condition applies to the S3 request itself, not directly to the KMS key usage. While KMS is involved in object encryption, the in-transit encryption is handled at the S3 endpoint.