A security engineer is setting up an AWS CloudTrail trail for all AWS Regions in an account. For added security, the logs use server-side encryption with AWS KMS (SSE-KMS) and log file integrity validation. During testing, the engineer can read the digest files but cannot read the log files. What is the most likely cause?

The most likely cause is that the KMS key policy does not grant the engineer's IAM user or role permission to decrypt the log files. CloudTrail logs are encrypted with SSE-KMS, meaning decryption requires appropriate KMS permissions. While the engineer can read digest files (which are not encrypted with the same KMS key or may not require decryption for basic access), accessing the encrypted log files themselves fails due to missing KMS decrypt permissions. Incorrect options: Log file integrity validation failure would not prevent reading the files; it would indicate tampering or corruption. S3 buckets configured with SSE-S3 as default can still accept SSE-KMS-encrypted objects, as object-level encryption overrides bucket defaults. An IAM policy denying access to the 'CloudTrail/' prefix would prevent reading both digest and log files, not just the log files.