A research center migrated 1 PB of on-premises object storage into a single Amazon S3 bucket. 100 scientists each have a personal folder; all scientists are members of one IAM user group. The compliance officer wants to prevent scientists from accessing each other’s data and must report which scientist accessed which objects. The reporting team has little AWS experience and prefers a ready-to-use, low‑operational-overhead solution. Which two actions should a solutions architect recommend? (Choose two.)

Creating an identity policy with a Condition that restricts access to an S3 object key prefix matching ${aws:username} ensures each scientist can only access objects within their personal folder, effectively preventing them from accessing each other's data. Attaching this policy to the IAM user group centralizes management. Enabling an AWS CloudTrail trail for S3 object-level events captures all data access activities, including which user accessed which objects. Delivering these logs to another S3 bucket and querying them with Amazon Athena provides a ready-to-use, low-operational-overhead solution for reporting, as Athena can directly query data in S3. S3 server access logging provides less granular detail than CloudTrail object-level events and may not clearly identify the specific IAM user. A broad S3 bucket policy without conditions would grant all scientists access to all data, violating the isolation requirement. While CloudWatch Logs can store CloudTrail events, querying them directly with Athena via a connector adds complexity compared to Athena querying S3 directly, which is simpler for a team with limited AWS experience.