Below is the diagram for encrypting S3 Object data with Key Management Service (KMS), logging with Amazon CloudTrail, and querying data with Amazon Athena. You can refer to: