One of your requirements is to set up an S3 bucket to store your files like documents and images. However, those objects should not be directly accessible via the S3 URL. They should only be accessible from pages on your website so that only your paying customers can see them. How could you implement this?

Answer options:

A.Use HTTPS endpoints to encrypt the data in the S3 bucket.
B.You can use a bucket policy with the aws:referer key in a condition where the key must match your domain. Browsers should include the HTTP referer header in the request.
C.You can`t. The S3 URL must be public in order to use it on your website.
D.You can use server-side and client-side encryption. Only your application can decrypt the objects.

Answer – B
Suppose you have a website with the domain name (www.example.com or example.com) with links to photos and videos stored in your S3 bucket, examplebucket. By default, all the S3 resources are private, so only the AWS account that created the resources can access them. To allow read access to these objects from your website, you can add a bucket policy that allows s3:GetObject permission with a condition, using theaws:referer key. The get request must originate from specific web pages.
Option A is incorrect because the HTTPS endpoint will not ensure that only authenticated users can get access to the content. 
Option B is CORRECT because it defines the appropriate bucket policy to give access to the S3 content to the authenticated users. Refer to page 390 under section "Restricting Access to a Specific HTTP Referer" in the below link
https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-dg.pdf
Option C is incorrect because you can control the access to the S3 content via bucket policy.
Option D is incorrect because the question is not about encrypting/decrypting the data. The proper bucket policy needs to be defined to give access to the S3 content to certain users.
For more information on S3 bucket policy examples, please visit the link-
http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html