A company requires data-lake clients to use TLS when accessing S3. It wants a bucket-level enforcement control while accounting for applicable AWS service access. Which policy approach should it evaluate?

1. An appropriate explicit deny for non-TLS requests using aws:SecureTransport, scoped and tested for the required principals and service behavior.
2. Require only a particular object storage class as the condition for all requests.
3. Allow HTTPS access but omit any deny or equivalent control on otherwise authorized HTTP requests.
4. Enable default encryption at rest and assume that alone prevents HTTP requests.