A policy allows s3:GetObject on a bucket ARN but requests for objects are denied. There are no other grants or denies. What is the likely correction?

1. Allow DNS queries to the bucket and remove IAM authentication.
2. Use the appropriate object ARNs for GetObject rather than only the bucket ARN.
3. Add ListBucket only and assume it includes object reads.
4. Rename the bucket so its name contains the action.