An S3 bucket uses default SSE-KMS encryption. Older objects were written before the setting changed. What additional work may be required to meet an all-object encryption requirement?

1. No work is needed because changing the default rewrites all historical objects instantly.
2. Change the bucket DNS name and assume the stored ciphertext changes.
3. Inventory existing objects and perform an approved re-encryption operation where required.
4. Delete the KMS key to force S3 to generate encrypted replacements.