A marketing team serves images and scripts for its website from an S3 bucket through an Amazon CloudFront distribution. The bucket has S3 Block Public Access turned on, and every object is encrypted with SSE-KMS using a customer managed key.
Security requires that viewers can fetch the objects only through CloudFront and never directly from Amazon S3 URLs. Which configuration should the architect use?