Your company is developing an application that needs to interact with an S3 bucket. There is a requirement that all data in the bucket is encrypted at rest. You also need to ensure that you manage the keys. Which of the following options can you use for this purpose? (Select TWO)

Answer options:

A.Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
B.Server-Side Encryption with AWS KMS Keys stored in AWS Key Management Service (KMS)
C.Server-Side Encryption with with Customer-Provided Keys (SSE-C)
D.Client-Side Encryption

Answer – C and D
This is given in the AWS Documentation.
Use Server-Side Encryption with Customer-Provided Keys (SSE-C). You manage the encryption keys, and Amazon S3 manages the encryption, as it writes to disks and decryption, when you access your objects.
You can encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.
Options A and B are incorrect since these keys are managed by AWS.
For more information on Server-side encryption for S3, please refer to the below URL-
https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html