Which method can be used to prevent an IP address block from accessing public objects in an S3 bucket?

A.
Create a bucket policy and apply it to the bucket

B.
Create a NACL and attach it to the VPC of the bucket

C.
Create an ACL and apply it to all objects in the bucket

D.
Modify the IAM policies of any users that would access the bucket

Explanation:
http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html