What can CloudFront see if Tor is involved?

CloudFront has an origin configuration, and AWS can see the endpoint configured there. That might be an AWS resource or an endpoint hosted somewhere else. Knowing that endpoint does not necessarily reveal every server or network hop behind it.

If the configured origin is a proxy, for example, CloudFront sees the proxy as its origin. The proxy might forward requests to another backend that is not apparent from the distribution configuration alone.

The direction of the traffic matters here. CloudFront cannot directly fetch an onion address as a Tor client. A setup that uses CloudFront in front of an onion service would need an intermediary that CloudFront can reach and that can connect to Tor.

AWS would have visibility into the configured intermediary endpoint. That alone would not establish where the onion service is physically hosted.

There is another possible arrangement: the onion service could make requests to CloudFront for content rather than sit behind it as the origin. Seeing CloudFront involved somewhere does not tell you which direction requests are flowing or prove that it fronts the onion service.

For HTTPS served by CloudFront, TLS terminates at CloudFront. CloudFront can then use a separate connection to the origin. Application data could also be encrypted separately inside that connection, so visibility into the transport does not automatically mean visibility into every piece of content.