While most of your statement is true, it was direct-from-AWS (at least from my testing, so I'm not sure if some users were routed through Cloudflare).