A company centrally stores all AWS CloudTrail logs in an Amazon S3 bucket managed by the security team. The team must prevent unauthorized access and detect or prevent any tampering of the logs. Which combination of actions should be implemented? (Choose three.)

Enabling SSE-KMS encrypts the logs at rest, protecting them from unauthorized access even if the underlying storage is compromised. Enforcing least-privilege access via a bucket policy ensures only authorized personnel or services can read or modify the logs, preventing tampering. CloudTrail log file integrity validation uses cryptographic hashing to detect any changes, deletions, or additions to the log files after they are delivered to S3, providing proof of non-tampering. Compressing logs saves storage but doesn't enhance security. An EventBridge rule could alert to modifications but doesn't prevent them or validate integrity. Access Analyzer for S3 helps identify unintended access but doesn't directly prevent tampering or encrypt data.