Your financial services organization is using the AWS S3 service to store highly sensitive data. What is the correct IAM Policy that must be applied to ensure that all objects uploaded to the S3 bucket are encrypted?

Answer options:

A.{
 "Version":"2012-10-17",
 "Id":"PutObjPolicy",
 "Statement":[{
 "Sid":"DenyUnEncryptedObjectUploads",
 "Effect":"Deny",
 "Principal":"*",
 "Action":"s3:PutObject",
 "Resource":"arn:aws:s3:::SensitiveDataBucket/*",
 "Condition":{
"StringNotEquals":{
 "s3:x-amz-server-side-encryption":"AES256"
}
 }
}
 ]
}
B.{
 "Version":"2012-10-17",
 "Id":"PutObjPolicy",
 "Statement":[{
 "Sid":"DenyUnEncryptedObjectUploads",
 "Effect":"Deny",
 "Principal":"*",
 "Action":"s3:PutObject",
 "Resource":"arn:aws:s3:::SensitiveDataBucket",
 "Condition":{
"StringNotEquals":{
 "s3:x-amz-server-side-encryption":"AES256"
}
 }
}
 ]
}
C.{
 "Version":"2012-10-17",
 "Id":"PutObjPolicy",
 "Statement":[{
 "Sid":"DenyUnEncryptedObjectUploads",
 "Effect":"Deny",
 "Principal":"*",
 "Action":"s3:PutObject",
 "Resource":"arn:aws:s3:::SensitiveDataBucket/*",
 "Condition":{
"StringNotEquals":{
 "s3:sse-encryption-cipher":"AES256"
}
 }
}
 ]
}
D.{
 "Version":"2012-10-17",
 "Id":"PutObjPolicy",
 "Statement":[{
 "Sid":"DenyUnEncryptedObjectUploads",
 "Effect":"Deny",
 "Principal":"*",
 "Action":"s3:PutObject",
 "Resource":"arn:aws:s3:::SensitiveDataBucket",
 "Condition":{
"StringNotEquals":{
 "s3:sse-encryption-cipher":"AES256"
}
 }
}
 ]
}

Answer: A
Option A is CORRECT because you must use the s3:x-amz-server-side-encryption condition key to ensure all objects uploaded in the S3 bucket are encrypted.
Option B is incorrect because the resource should be "arn:aws:s3:::SensitiveDataBucket/*" instead of "arn:aws:s3:::SensitiveDataBucket".
Option C is incorrect because you must use the s3:x-amz-server-side-encryption condition key to ensure all objects uploaded in the S3 bucket are encrypted.
Option D is incorrect because you must use the s3:x-amz-server-side-encryption condition key to ensure all objects uploaded in the S3 bucket are encrypted.
Reference:
In order to grant s3: PutObject permission requiring objects stored using Server-Side Encryption, the Account administrator can accomplish using the s3:x-amz-server-side-encryption condition key as shown. The key-value pair in the Condition block specifies the s3:x-amz-server-side-encryption key.
"Condition": {
 "StringNotEquals": {
 "s3:x-amz-server-side-encryption": "AES256"
 }
https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html