The problem I find with S3 and CloudFront is no restriction based on referrer. It can be addressed with some moving of the files and dynamic HTML but that would kill caching and might break on some browsers.
I was trying to do this last week, and found this: http://drydrop.binaryage.com/
It updates Google App Engine from a github repository. Push your changes, and they're online. It's very easy to setup.