A tech company is building a file-sharing web application that stores files in an Amazon S3 bucket. All file access must go through Amazon CloudFront to improve performance and control distribution. To protect the files from being accessed directly via their public S3 URLs, the company wants to ensure that only requests coming through CloudFront can retrieve the content. What should a solutions architect do to meet these requirements?