A developer hosts a static, public website in an S3 bucket and delivers it through CloudFront. The requirement is that users must not be able to retrieve content directly from the S3 bucket — all access must go through the CloudFront distribution. Which solution enforces this requirement?

Creating a CloudFront Origin Access Control (OAC) is the correct solution. OACs enhance security by allowing CloudFront to securely access S3 buckets, even private ones, while preventing direct public access to the bucket. You configure the CloudFront distribution to use the OAC, and then update the S3 bucket policy to grant read access specifically to that OAC. This ensures all content requests must pass through CloudFront. Enabling S3's Block All Public Access is a good security practice but doesn't, by itself, grant CloudFront access, and granting CloudFront write access is unnecessary and insecure for a static website. Enabling static website hosting on S3 and using the website endpoint as the origin allows direct S3 access, which violates the requirement. Custom headers with aws:RequestTag are not the standard or most secure way to restrict S3 access to CloudFront; OACs are designed for this purpose.