If the Origin server is an AWS S3 endpoint and the relative IAM policy is to be authenticated with a credential, this use case is not currently supported by F5 XC CDN service.

This feature is available in https://github.com/nginx/nginx-s3-gateway "For internal/micro services that can't authenticate against the S3 API (e.g. don't have libraries available) the gateway can provide a means to accessing S3 objects without authentication"". So the workaround is to deploy a NGINX gateway in vK8S (CE or RE). But this implementation is not "SaaS" but CaaS managed by the customer.