Earlier quoted context omitted.
If I understand what you're saying, if the origin for your Cloudfront distribution is an S3 bucket, the link between S3 and Cloudfront is unencrypted? That seems unimaginable to me.
If the origin is an S3 static website, the link is unencrypted but should run over Amazon's own network. Since Amazon has your S3 and CloudFront data anyway, assuming all CF endpoints are under Amazon's control, you don't lose much by having the S3 origin load over http.
It could just as easily be connecting with s2n and authenticating both endpoints of the connection.