A financial services company is building a new application on AWS. They must ensure that all data at rest is encrypted using keys managed by the company (Customer Managed Keys). The security team requires that the encryption keys are automatically rotated every year, and that specific IAM roles can only use the keys for encryption, not decryption. Which combination of actions should the Architect take? (Select THREE)

Create an AWS KMS Customer Managed Key (CMK) with automatic key rotation enabled.

Define a key policy that grants the kms:Encrypt action to the specific IAM roles.

Define a key policy that explicitly denies the kms:Decrypt action for the specific IAM roles.

Use AWS CloudHSM to generate the keys and configure automatic annual rotation.

Create an AWS Managed Key and enable automatic rotation.

Use AWS Secrets Manager to store the KMS keys and configure a Lambda function for rotation.