An enterprise needs to ensure the encryption of sensitive data stored in their Amazon S3 buckets. The company has mandated that its own encryption keys must be used, which requires them to be periodically rotated and immediately disabled in the event of a security breach. Which of the following configurations should be implemented to meet these specific requirements?
Use Amazon S3-Managed Keys (SSE-S3) for encryption and handle rotation outside of AWS.
Create a customer-managed CMK in AWS KMS, enable manual rotation, and use this key to encrypt the S3 buckets.
Use AWS KMS managed keys and enable the automatic rotation feature, which occurs annually.
Use an AWS Managed CMK in AWS KMS without enabling key rotation.