A company has sensitive data stored in an Amazon S3 bucket that is encrypted using AWS Key Management Service (AWS KMS). A developer wants to enforce encryption in transit for all users who have been granted permission to use the S3 GetObject operation across multiple AWS accounts. Which of the following represents the best solution for this use case?