Trusted Advisor flags an S3 bucket policy that allows open access. The bucket owner explains the bucket is used as the origin for a CloudFront distribution. What is the appropriate action to ensure objects in S3 are served only via CloudFront and not directly from S3 URLs?

Creating a CloudFront Origin Access Identity (OAI) is the recommended and most secure method to restrict direct access to S3 bucket content while allowing CloudFront to serve it. The OAI acts as a virtual user with permissions to access your S3 bucket. You then modify the S3 bucket policy to grant read permissions only to this specific OAI. This ensures that users can only access your content through the CloudFront distribution, preventing direct S3 URL access. Encrypting objects (SSE-S3) protects data at rest but doesn't control access methods. Using an IAM user or role for CloudFront is not the correct or secure pattern; CloudFront has a dedicated mechanism (OAI) for this purpose, which is more tightly integrated and manageable.