are your media urls going straight to s3, or do you have custom code proxying your s3 bucket? with the latter you could look at user agent headers and drop obvious bots. not sure if cloudfront supports that kind of logic.
Discussion
Not on S3 yet, we are doing just that, looking at headers and bots. Thank you