A CDN origin must remain private to CloudFront over its public endpoint. The application requires authenticated origin requests rather than relying solely on an obscure hostname. Which S3 origin design is preferred?

1. Allow every AWS account in the bucket policy and disable request signing.
2. Use an S3 website endpoint and assume origin access control signs website requests.
3. Make the bucket public and keep its name out of application source code.
4. Use an S3 REST origin with origin access control and a scoped bucket policy.