A company delivers training videos through CloudFront from an S3 bucket's REST endpoint. Videos must be accessible through the designated distribution, but direct anonymous S3 requests must fail. Which solution meets these requirements?

1. Use an S3 website endpoint as the origin and restrict access with a CloudFront origin access control.
2. Keep S3 Block Public Access enabled, use an origin access control, and allow the CloudFront service principal with a distribution SourceArn condition in the bucket policy.
3. Make the bucket public and require signed URLs only at the CloudFront viewer endpoint.
4. Allow GetObject from all CloudFront edge-location IP ranges without configuring origin authentication.