A Solutions Architect has been asked to design a solution that will deliver digital content to users through Amazon CloudFront. You have set up an Amazon S3 bucket as the origin and by default, CloudFront never exposes Amazon S3 URLs. The contents should only be accessed through the CloudFront distribution. How can this be achieved?

Answer options:

A.Store the digital contents in the S3 bucket and create signed URLs to access S3 through CloudFront.
B.Create OAI in CloudFront. Use the S3 bucket policy to ensure that only the OAI can access the files in the Amazon S3 bucket.
C.Store the digital contents as private objects in the S3 buckets and use the S3 ACL to ensure that only the CloudFront distribution ARN can access the bucket.
D.Store the digital contents in the S3 bucket and configure signed cookies for users to access contents through CloudFront.

Answer: B
When you first set up an Amazon S3 bucket as the origin for a CloudFront distribution, you grant everyone permission to read the files in your bucket which allows anyone to access your files either through CloudFront or using the Amazon S3 URL. CloudFront doesn`t expose Amazon S3 URLs, but your users might have those URLs if your application serves any files directly from Amazon S3 or if anyone gives out direct links to specific files in Amazon S3.
If you use CloudFront signed URLs or signed cookies to restrict access to files in your Amazon S3 bucket, you probably also want to prevent users from accessing your Amazon S3 files by using Amazon S3 URLs. If users access your files directly in Amazon S3, they bypass the controls provided by CloudFront signed URLs or signed cookies.
Option A is incorrect because signed URLs cannot ensure that the contents can only be accessed through CloudFront.
Option B is CORRECT as it ensures that the contents are only delivered through the CloudFront distribution.
Option C is incorrect because OAI should be created and configured in the bucket policy. This option is invalid to control the access for the S3 bucket.
Option D is incorrect because signed cookies cannot ensure that the contents are only accessed through CloudFront.
References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-restricting-access-to-s3-overview
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-choosing-signed-urls-cookies.html