An audit trail records bucket configuration changes but does not show which principal read sensitive input objects. The team needs future GetObject audit events for one restricted prefix while limiting unrelated event volume. Which change is required?

1. Use S3 Versioning as a log of every reader identity.
2. Use only an aggregate S3 request metric and assume it identifies the principal for each individual read.
3. Enable CloudTrail S3 data events for the required read operations and source resource scope.
4. Enable only more management-event trails and expect GetObject records to appear automatically.