We are trying to make our web app the most cost effective and secure we can. For that reason we are using Cloudflare instead of CloudFront as a CDN for our frontend resources. We put CloudFront between Cloudflare and S3 to be able to use Full SSL (strict). This is required because we have a subdomain for API Gateway, which needs SSL to avoid infinite loops generated when using Cloudflare Flexibe SSL
The problem is that AWS documentation on connecting S3 with CloudFront for Website hosting instructs on allowing public access to the bucket contents (1), while Cloudflare recommends restricting access to Cloudflare Servers IPs to disallow public requests to the website buckets (2, 3)
Specifically, we want to be able to use Cloudflare free DDoS protection effectively. Such that we avoid potentially high costs related to receiving DDoS attacks directly into our AWS deployed resources, and the need of using other non free services as AWS WAF
So my question is, given an architecture using Cloudflare, CloudFront and S3 website bucket with public access bucket policy, is there a DDoS vulnerability, specifically with respect to CloudFront and S3 not being properly protected by Cloudflare?