Your company currently has a set of images that are placed in an S3 bucket. To give a better user experience worldwide, you have created a CloudFront distribution with the S3 bucket as the origin. But in your monitoring reports, you see that many users bypass the CloudFront URL and directly go to the S3 bucket and download the images. Which of the following steps can be performed to remediate this issue? (Select TWO)

Answer options:

A.Create a CloudFront Origin Access Identity.
B.Create a separate IAM user.
C.Ensure that only the CloudFront Origin Access Identity has access to read objects from the S3 bucket.
D.Ensure that only the IAM user has access to read objects from the S3 bucket.

Correct Answers:A and C
The AWS Documentation mentions the following.
To ensure that your users access your objects using only CloudFront URLs, regardless of whether the URLs are signed, perform the following tasks.
Create an origin access identity, which is a special CloudFront user, and associate the origin access identity with your distribution. (For web distributions, you associate the origin access identity with origins so that you can secure all or just some of your Amazon S3 content.) You can also create an origin access identity and add it to your distribution when you create it.
Change the permissions either on your Amazon S3 bucket or on the objects in your bucket. So only the origin access identity has read permission (or read and download permission). When your users access your Amazon S3 objects through CloudFront, the CloudFront origin access identity gets the objects on behalf of your users. If your users request objects directly by using Amazon S3 URLs, they`re denied access. The origin access identity has permission to access objects in your Amazon S3 bucket, but users don`t.
Options B and D are incorrect since you need to create a CloudFront origin access identity and not an IAM user.
For more information on private content for S3, please refer to the below URL-
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html