The data platform requires TLS for S3 access while preserving intended AWS service delivery. Which bucket-policy control should be evaluated?

1. An appropriate deny using aws:SecureTransport, with principal and service-access behavior tested.
2. Only default encryption at rest, assumed to prohibit HTTP automatically.
3. A response Content-Type value of tls for every object.
4. Only a bucket name ending in secure.