use KeyPrefix in the validation

this is in case the bucket has a more restrictive
policy