If you’re statically hosting on s3 then that isn’t an option while also supporting tls. You need something in front. You can go the cloudfront route but last time I looked it was all a bit of a pain. Cloudflare takes minutes to set up and the whole thing will be done and maintenance free.