Isn’t dot in bucket name irrelevant if he is going to cache the images via CDN anyway? The only thing that matters is having good cert that covers cloudflare served image.
I think he needs to be focused on cloudflare servers, DNS and cert to cover that stuff. I don’t think user/browser ever will know that the source of these images is S3 bucket. Cloudflare will cache/proxy the image itself, right?