My usecase was :

• the CDN was delivering images from a S3 bucket
• the images URL pattern was https://URL/images/something.jpg
• there was not an "images" folder at the root of the S3 bucket, images like something.jpg were directly there

So I used this function and associated it to the right Behavior ("Viewer request" option) of my CloundFront Distribution :

function handler(event) {

    var request = event.request;

    if (request.uri.startsWith("/images/")) {
        request.uri = request.uri.substring(7);
    }

    return request;
}

Let me know if that helped you or if you have suggestion for improvements. Take care !