> Dumb question but would an S3 bucket be scanned by CSAM?

Maybe, but if you E2EE it can't detect anything, anyway. (Please don't take this as an endorsement of child porn) NextCloud has preliminary E2EE support built in, but not for photos - yet.