What should be monitored to better understand the extent of this issue?

Explanations:

The GetRequests metric on Amazon S3 tracks the number of GET requests made to the S3 bucket but does not specifically provide insight into missing or unauthorized photos.

The 4XXErrorRate metric on CloudFront tracks client-side errors, such as 404 (Not Found) and 403 (Forbidden), which are likely causes of users accessing photos that don’t exist or are unauthorized.

The 5XXErrorRate metric on CloudFront tracks server-side errors (e.g., 500 series errors), which are typically unrelated to missing or unauthorized content, which is a client-side issue.

The PostRequests metric on S3 counts POST requests, which are irrelevant to accessing static content like photos. This metric does not pertain to issues with missing or unauthorized photo access.