An application running on Amazon EC2 instances needs to retrieve objects from an Amazon S3 bucket. All objects in the bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The VPC has no internet access and uses a gateway VPC endpoint for Amazon S3. The application cannot retrieve objects. Which factors could be causing this issue? (Choose three.)

The application needs s3:GetObject to retrieve objects, but s3:ListBucket is often a prerequisite for many S3 SDK operations to enumerate or verify bucket contents, making its absence a potential cause. The objects are KMS-encrypted, so the EC2 instance's IAM role must have kms:Decrypt permissions on the specific KMS key used; without this, the instance cannot decrypt the objects. Since the VPC uses a gateway VPC endpoint for S3, the S3 bucket policy must explicitly allow access from the VPC endpoint or the specific VPC/principals accessing it, otherwise, requests will be denied. s3:ListParts is for multipart uploads, not general object retrieval. kms:ListKeys is for listing KMS keys, not for decrypting specific objects. Security groups control network traffic; while important, the S3 gateway endpoint handles routing, and the issue is likely authorization, not network reachability, especially since S3 is a public service accessed via HTTPS (port 443).