A CloudFront distribution uses an S3 REST endpoint as its origin. The bucket must stay private, and viewers should access objects through the distribution rather than directly from S3. Which configuration is recommended?

1. Allow reads only when the Referer header equals the distribution hostname and keep the bucket publicly reachable.
2. Configure CloudFront Origin Access Control with request signing and a bucket policy allowing the distribution to read the required objects.
3. Use an S3 website endpoint with Origin Access Control and assume it supports the same signed-origin mechanism.
4. Make the bucket public and rely on an obscure distribution hostname to prevent direct reads.