A security engineer needs to configure an Amazon CloudFront distribution in front of an Amazon S3 bucket that hosts a static website. Access must be allowed only from a specified set of client IP addresses, and users must not be able to access the content directly through S3 URLs. Which solution meets these requirements?

The correct solution uses CloudFront Origin Access Control (OAC) to restrict direct S3 access, ensuring content is served only through CloudFront. The S3 bucket policy is updated to grant access exclusively to the OAC. An AWS WAF web ACL with an IP set rule is then associated with the CloudFront distribution. This WAF rule filters incoming requests based on the specified client IP addresses, allowing only authorized traffic to reach CloudFront and subsequently the S3 bucket. The other options are incorrect because: Attaching a bucket policy with cloudfront.amazonaws.com as the principal and aws:SourceIp condition would not work as aws:SourceIp evaluates the client IP, not CloudFront's edge IP, and cloudfront.amazonaws.com isn't a valid principal for source IP conditions. Security groups are not applicable to S3 buckets directly; they are used with EC2 instances and other network interfaces. S3 Access Points can restrict access but don't inherently prevent direct S3 URL access if permissions are broad, and they don't provide IP-based filtering at the edge. The WAF part is correct but the S3 access point doesn't fully solve the direct S3 access problem in conjunction with IP restrictions.