There is not really meaningful difference between service fully hosted on AWS (or GCP/Azure) vs service hosted otherwise on AWS and putting Cloudflare in front

There is not really meaningful difference between service fully hosted on AWS (or GCP/Azure) vs service hosted otherwise on AWS and putting Cloudflare in front of it. That shows how meaningless idea it is to try to block AWS based services as an end-user. On a technical level you can not know what the supply chain of a service is like. If you are concerned about supply chains, then Microsoft owning GitHub, which almost everyone uses more or less directly, probably should pop up high in the list of things. But for an end-user I'd again question if that is a meaningful concern.