A company wants a single S3 bucket for data scientists to store work documents. Users authenticate via AWS IAM Identity Center, and the data scientists are in a specific Identity Center group. The company needs each scientist to access only their own documents and requires monthly reports showing which documents each user accessed. Which combination of steps satisfies these requirements? (Choose two.)

To ensure each scientist accesses only their own documents, a custom IAM Identity Center permission set with an IAM policy using the aws:PrincipalTag/userName condition is effective. This dynamically restricts access to S3 prefixes matching the user's username, providing granular, user-specific isolation within a single bucket. The other option, creating a single role for the group, would grant all members access to all documents, failing the isolation requirement. For monthly access reports, enabling AWS CloudTrail to log S3 data events (object-level API calls) and delivering them to an S3 bucket is crucial. Amazon Athena can then query these logs to generate detailed reports on who accessed which documents. Configuring CloudTrail for management events only would miss object-level access details. S3 access logging is less detailed than CloudTrail data events for this purpose, and EMRFS is not relevant here.