The cloud providers all have public lists of their IP ranges, so there's a fastly ACL for each provider/zone pair and for matching IPs, some custom VCL serves a HTTP redirect to the HTTP url for the appropriate cloud provider's cloud storage solution (S3, GCS, etc.). On the VMs, these resolve to appropriate internal IPs to obtain data from the storage service without charge.