A developer hosts a static website in an S3 bucket served through CloudFront using origin access control (OAC) so the bucket is not public. Users can access explicit file URLs (for example, /products/index.html) but receive an error when requesting directory URLs (for example, /products/). Without making the S3 bucket public, how can directory requests be served so they return the default index file?

The correct solution is to use a CloudFront viewer-request function. When a user requests a directory URL like /products/, the Lambda@Edge function can detect this pattern and rewrite the URL to /products/index.html before CloudFront forwards the request to the S3 origin. This allows S3 to serve the default index file without exposing the bucket publicly or enabling S3 static website hosting, which would bypass OAC. Changing the CloudFront default root object to index.html only applies to the root of the distribution (e.g., /), not subdirectories. Enabling S3 static website hosting would require changing the CloudFront origin to the S3 website endpoint, which does not support OAC and would require the bucket to be public or use a bucket policy that grants public read access, contradicting the requirement. Configuring a custom error response for 404 would only work after a 404 error has occurred, which is inefficient and not the intended behavior for directory requests.