Which solution will meet these requirements?
In the S3 bucket properties, change the default encryption to SSE-S3 with a customer managed key. Use the AWS CLI to re-upload all objects in the S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests.
In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket.
In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to automatically encrypt objects on GetObject and PutObject requests.
In the S3 bucket properties, change the default encryption to AES-256 with a customer managed key. Attach a policy to deny unencrypted PutObject requests to any entities that access the S3 bucket. Use the AWS CLI to re-upload all objects in the S3 bucket.
Explanations:
Changing the default encryption to SSE-S3 with a customer managed key does not apply the new encryption to existing objects. Additionally, the company needs to manage keys, which SSE-S3 does not provide. Re-uploading objects would not enforce the use of customer-managed keys.
By changing the default encryption to SSE-KMS, all new objects will be encrypted with keys managed by AWS KMS, which the company can control. Re-uploading existing objects ensures they are encrypted with the new keys. The bucket policy will enforce encryption for future uploads.
While changing to SSE-KMS will ensure that new objects are encrypted, setting a policy to automatically encrypt on GetObject and PutObject requests is not valid. The bucket policy cannot enforce encryption automatically during retrieval and would not retroactively encrypt existing objects.
AES-256 is not a valid configuration for customer-managed keys in S3; the correct option is SSE-KMS. Additionally, changing to AES-256 does not provide the required key management and does not retroactively encrypt existing objects without re-uploading.
I rate that the answer is:
In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket.