Heads up a simple yet production ready NGINX location block to proxy to a public s3 bucket looks like:

    # matches /s3/*
    location ~* /s3/(.+)$ {
        set $s3_host 's3-us-west-2.amazonaws.com';
        set $s3_bucket 'somebucketname'

        proxy_http_version 1.1;
        proxy_ssl_verify on;
        proxy_ssl_session_reuse on;
        proxy_set_header Connection '';
        proxy_set_header Host $s3_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Authorization '';
        proxy_hide_header x-amz-id-2;
        proxy_hide_header x-amz-request-id;
        proxy_buffering on;
        proxy_intercept_errors on;
        resolver 8.8.4.4 8.8.8.8;
        resolver_timeout 10s;
        proxy_pass https://$s3_host/$s3_bucket/$1;
    }

Adding NGINX caching on-top of this is pretty trivial.

Also, heads up, in the directive proxy_cache_path, they should consider enabling "use_temp_path". This directive instructs NGINX to write them to the same directories where they will be cached. We recommend that you set this parameter to off to avoid unnecessary copying of data between file systems. use_temp_path was introduced in NGINX version 1.7.10 and NGINX Plus R6.

    use_temp_path=off

Also, they should enable "proxy_cache_revalidate". This saves on bandwidth, because the server sends the full item only if it has been modified since the time recorded in the Last-Modified header.

    proxy_cache_revalidate on;