The Free Radical Ansible
repo commit 5d91a34 now supports both pre-Mastodon 2.1 and Mastodon 2.1+ S3 media URLs in CSP headers.