A company hosts a private S3 origin behind CloudFront. It must prevent direct public object reads while allowing only its distribution to retrieve content. Which configuration is preferred?

1. Use origin access control with an S3 REST origin and a scoped bucket policy.
2. Make the bucket public and hide its hostname in the application.
3. Use an S3 website endpoint and assume OAC supports the same signed S3 origin behavior.
4. Allow every AWS principal to read the bucket without distribution conditions.