A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration The company needs to…

Amazon S3 is a fully managed object storage service designed for high durability (99.999999999%) and availability, making it ideal for storing large, important documents. The solution meets all requirements directly:
1. Encryption in transit: A bucket policy can enforce the use of HTTPS (TLS) for all data transfers.
2. Encryption at rest: Server-Side Encryption with AWS Key Management Service (SSE-KMS) encrypts objects using a KMS key.
3. Key Management: Using SSE-KMS with a customer-managed key gives the company full control over the key's lifecycle, including periodic rotation, which can be automated within AWS KMS. This approach leverages fully managed services to meet all security and operational requirements efficiently.

A. Storage Gateway is a hybrid cloud service for connecting on-premises infrastructure to AWS storage. It is not the most direct, fully managed solution for a new cloud-native application.
C. Amazon DynamoDB is a NoSQL database with a maximum item size of 400 KB. It is unsuitable for storing "large, important documents" and is designed for structured key-value data, not files.
D. Using EC2 instances with EBS volumes is an Infrastructure as a Service (IaaS) approach, not a fully managed service. It requires managing the operating system and instances, and EBS has lower native durability than S3.

1. Amazon S3 Durability and Availability: AWS. (n.d.). Amazon S3 FAQs. "Amazon S3 is designed for 99.999999999% (11 9's) of durability... Amazon S3 Standard... is designed for 99.99% availability over a given year."

2. S3 Encryption with Customer-Managed Keys: AWS. (2023). Protecting data using server-side encryption with AWS Key Management Service keys (SSE-KMS). S3 User Guide. "When you use SSE-KMS, you can use the AWS managed key... or you can create and manage your own symmetric customer managed key."

3. Enforcing Encryption in Transit: AWS. (2023). Managing access with policies. S3 User Guide. A bucket policy can use the aws:SecureTransport condition key to deny any requests that are not sent over HTTPS.

4. KMS Key Rotation: AWS. (2023). Rotating AWS KMS keys. AWS Key Management Service Developer Guide. "You can enable automatic key rotation for a customer managed key... AWS KMS rotates the KMS key 365 days after the enable date and every 365 days thereafter."

5. DynamoDB Item Size Limit: AWS. (2023). Service, account, and table quotas in Amazon DynamoDB. Amazon DynamoDB Developer Guide. "The maximum item size in DynamoDB is 400 KB, which includes both attribute name and value lengths (binary and text)."