Serving a private S3 bucket through CloudFront (OAC)

The bucket stays private; only CloudFront can read it, authenticated via Origin Access Control

Browser end user
Amazon CloudFront
CloudFront CDN, edge, HTTPS
Amazon S3
S3 bucket static origin private
OAC
client AWS service Origin Access Control