User uploads are handled by repositories. There is an existing repository module for S3 however I don't know if it has granular access control (S3 tokens etc) but this should be implemented if not. Additionally, any other files served to the user from the data directory should be placed in S3 or another remote backend as well, such as themes. I would propose specific code for S3, and then for any other basic CDN, as in "files are here, use this URL prefix for them" kind of deal.