A: Use dynamic IAM policies with {aws:PrincipalTag/userName} to enforceprefix-level access control— i.e., bucket/userA/*, bucket/userB/*.

C: Enable CloudTraildata eventsto capture object-level access andquery them withAthena. This is the AWS-recommended way to audit per-user object access.

Incorrect:

B doesn ' t provide user isolation.

D only capturesmanagement events, not object-level data access.

E is legacy, inefficient, and not structured for per-user auditing.