This was a pretty silly mistake. The url, path and host alias need to go on the same level as the s3_credentials
:url => ':s3_alias_url',
:s3_host_alias => ENV['CLOUDFRONT_URL'],
:path => ":attachment/:id/:style.:extension",
:s3_credentials => {
:bucket => ENV['AWS_BUCKET'],
:access_key_id => ENV['AWS_ACCESS_KEY_ID'],
:secret_access_key => ENV['AWS_SECRET_ACCESS_KEY']
}