An S3 download fails for an SSE-KMS object despite an s3:GetObject allow. No explicit denies exist. Which additional authorization is relevant?

1. kms:Decrypt for the object key, with an appropriate key-policy or grant authorization path.
2. A public bucket policy that bypasses every KMS check.
3. Only s3:ListAllMyBuckets on the account.
4. Only kms:GenerateDataKey, with no decrypt permission.