A company has sensitive customer data that must be encrypted at rest in an Amazon S3 bucket. The company must also comply with regulatory requirements that mandate the periodic rotation of encryption keys. Which solution fulfills these requirements and is considered the BEST practice?
Enable Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) on the S3 bucket and leverage automatic key rotation in AWS KMS.
Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) on the S3 bucket and rotate the keys periodically with a custom solution.
Enable Server-Side Encryption with AWS CloudHSM-Managed Keys on the S3 bucket.
Implement Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) on the S3 bucket.