Users of a new application upload documents to Amazon S3 and the document contents must not be accessible to any third party. Which type of encryption will meet this requirement?

SSE-S3 encrypts objects using keys managed by Amazon S3. This ensures that the document contents are encrypted at rest and are not accessible to unauthorized third parties, fulfilling the requirement. The encryption and decryption are handled transparently by S3 when objects are uploaded or retrieved. Client-side encryption with a raw RSA key stored on the user's device is less secure because the key management is the user's responsibility, increasing the risk of key compromise. SSE-KMS and DSSE-KMS offer stronger security controls and auditability through AWS KMS, but SSE-S3 is sufficient to meet the basic requirement of preventing third-party access to document contents at rest, and is often simpler to implement.