Off the top of my head, it would have to be a fancy Workers script. You’d have to already have those subdomains set up in Cloudflare DNS, and the fancy Worker script assigned to the route *.example.com/* (this kinda blows up if someone tries to go to the ‘www’ hostname for your site, though)
Then the script would have to read the hostname, and make it the folder name of your bucket.
A model script is below, but I don’t see how AWS could do this since the bucket is mapped to a hostname.