You must implement client-side encryption for objects uploaded to a new Amazon S3 bucket using a customer master key (CMK) in AWS KMS. An IAM role has a policy attached, and tests show the role can read existing test objects from the bucket, but uploads fail with a forbidden error. Which KMS action must be added to the IAM policy so uploads succeed while meeting requirements?

For client-side encryption with a KMS CMK, the client application needs to request a data key from KMS to encrypt the object locally before uploading it to S3. The kms:GenerateDataKey permission allows the IAM role to make this request. Without it, the client cannot obtain the necessary key, leading to the "forbidden" error during upload. kms:GetKeyPolicy allows viewing a key's policy, not generating data keys. kms:GetPublicKey is for asymmetric keys and not relevant for symmetric data key generation. kms:Sign is for digital signatures, not encryption key generation.