A CloudFront distribution has a single Amazon S3 bucket as its origin. The administrator must ensure that objects in the bucket can only be retrieved through CloudFront, not by direct S3 URLs. Which configuration accomplishes this requirement?

Creating an Origin Access Identity (OAI) and associating it with your CloudFront distribution is the standard and most secure method to restrict direct access to your S3 bucket. The OAI acts as a virtual user that CloudFront uses to fetch content from S3. By updating the S3 bucket policy to grant s3:GetObject permissions only to this specific OAI, you ensure that requests originating from your CloudFront distribution are allowed, while direct S3 URL requests are denied. Enabling S3 Block Public Access is a good security practice but doesn't, by itself, grant CloudFront access. You would still need a bucket policy allowing CloudFront. Origin Shield is for improving cache hit ratios and reducing origin load, not for access control. Attaching an OAI directly to the S3 bucket or adding a custom header with an OAI value are not valid or effective configurations for this purpose.