Hi i have a similar issue. However, when querying the bucket i get denied

arn:aws:s3:::bucketname/AWSLogs/111111111/CloudTrail/ap-south-1/2025/07/09/111111111_CloudTrail_ap-south-1_20250709T1405Z_zwwNmrzBpawBJ0my.json.gz

Pretty much any prefix in AP.north or south. The bucket policy is lightly different.

            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::cloudtrailcentralizedbucket",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "AWSLogs/111111111/*",
                        "AWSLogs/111111111/CloudTrail/*",
                        "AWSLogs/111111111/CloudTrail/ap-northeast-2/*",
                        "AWSLogs/111111111/CloudTrail/ap-northeast-3/*",
                        "AWSLogs/111111111/CloudTrail/ap-southeast-1/*",
                        "AWSLogs/111111111/CloudTrail/ap-northeast-1/*"
                    ]
                }