Serving private AWS S3 files via R2 using signed links

My clients have files hosted in their own AWS S3 buckets which I want to serve via the R2 CDN edge locations.
Do I have to copy the AWS data to Cloudflare storage and use that or can I setup R2 to get the private files mirrored from S3 and generate signed URLs to the R2 files?