A company is storing sensitive documents in an Amazon S3 bucket and requires that only certain users are allowed to download and decrypt these documents. They want to ensure that the security controls in place enforce this policy strictly, even if other users have S3 bucket access. Which of the following solutions ensures that only authorized users can download and decrypt the sensitive documents?