A company hosts a web server on AWS and stores the site’s content in an Amazon S3 bucket. A security engineer must use Amazon CloudFront to accelerate content delivery, and the S3 content must not be publicly accessible directly from the bucket. Which solution meets these requirements?

Creating an Origin Access Control (OAC) is the recommended and most secure method to restrict direct access to an S3 bucket while allowing CloudFront to serve its content. The OAC acts as a trusted intermediary, and the S3 bucket policy is then configured to explicitly permit access only from this specific OAC. This ensures that users can only retrieve content through the CloudFront distribution, preventing direct S3 access. Configuring permissions on individual S3 objects is impractical and less secure for a large number of objects. An S3 role in IAM is not the correct mechanism for CloudFront to access S3. While an S3 bucket policy can be used, simply specifying the CloudFront distribution ID as the principal is less secure and flexible than using an OAC, which provides a more robust authentication and authorization mechanism.