Migrate to a new S3 bucket with default encryption, then transfer objects.

Apply default encryption to the current S3 bucket, identify unencrypted objects with Inventory, and encrypt them using Batch Operations.

Use AWS KMS to create an encryption key, enable server-side encryption with KMS keys on the S3 bucket, and enable versioning.

Manually encrypt each unencrypted S3 object through the AWS Management Console.