I think this is not about using s3 to serve files, but someone having verified owning s3 on bsky by putting some challenge file in his bucket. My guess, also missing context.
1. Bluesky allows you to use a domain as a handle by creating a TXT record on an _atproto subdomain of the domain you wish to use (see https://mxtoolbox.com/SuperTool.aspx?action=txt%3a_atproto.s... for mine)
2. You can also serve up your DID by having the URL "https://<handle>/xprc/com.atproto.identity.resolveHandle" return the DID.
3. AWS buckets have the URL structure http://s3.amazonaws.com/[bucket_name]/
4. register "xrpc" as an S3 bucket, drop a file named "com.atproto.identity.resolveHandle" with the correct JSON in it
5. boom! your username can now be s3.amazonaws.com
Hope that helps.
At a previous company I worked at, every bucket had the company name prefixed. Never had a problem with squatters.
I wonder if Amazon actually has any policies to prevent squatting.