An application generates reports and stores them in an Amazon S3 bucket. Users download reports via application-generated signed URLs. The security team discovered that the objects are publicly accessible and anyone can download them unauthenticated, so report generation was suspended. Which set of actions will immediately fix the security exposure without disrupting the application's normal download workflow?

The Amazon S3 Block Public Access feature is the most effective and immediate solution. Setting IgnorePublicAcls to TRUE for the bucket overrides any public ACLs, making objects private even if an ACL explicitly grants public access. This directly addresses the public accessibility issue without altering the application's signed URL generation, which relies on the bucket owner's permissions. Creating a Lambda function to deny access is an indirect and less immediate solution, as it requires scheduling and might not cover all access vectors. Reviewing Trusted Advisor recommendations is a good practice for long-term security but doesn't provide an immediate fix. Running a script to set private ACLs on every object is a valid approach, but Block Public Access is a more robust and centralized control that prevents future misconfigurations from making objects public via ACLs.