A company receives call logs as Amazon S3 objects that contain sensitive customer information. The company must protect the S3 objects by using encryption. The company must also use encryption keys th

AWS CloudHSM provides dedicated hardware security modules but involves significant operational overhead for management, which contradicts the 'least effort' requirement.

SSE-C requires the customer to provide and manage their own encryption keys for each object, increasing the management burden compared to using KMS managed keys.

SSE-KMS encrypts S3 objects using AWS Key Management Service (KMS) customer master keys (CMKs), which allows fine-grained access control through IAM policies to specify which employees or roles can use the keys. This solution offers strong security and key management capabilities with minimal operational overhead, meeting both encryption and controlled access requirements efficiently.

SSE-S3 uses keys managed entirely by Amazon S3, meaning customers do not have direct control over key access permissions to specific employees, failing that requirement.