A financial analytics company stores highly sensitive client data for analysis in an Amazon S3 bucket. Due to the sensitive nature of the data, the company requires that all files must be encrypted at rest using keys that they manage and control. They want the flexibility to rotate keys and enforce least privilege access to the encryption keys. Which S3 encryption method and key management option should the company use to securely encrypt their data while maintaining control over the encryption keys?