I can reply to the IPSEC part...but I struggle to see why DX would be any different. I will claim that I have never used DX, so be gentle if there is something special about it that I am unaware of.
It helps to look at Cloud APIC as another type of site in a multisite design (b/c it is a site). With that in mind, we know that for multisite to work, the spines need to set up some kind of control plane relationship with something in the cloud...in this case the CSR1Kvs in AWS. So for IPSEC access to AWS, you would always have your path via the spines for CP and for DP.
While I have not dug deeper than a precursory glance at it, I don't think DX would be any different. This is to say the spines set up OSFP to some WAN device you control (your ISN). That WAN device has some way to reach AWS (using IPSEC or DX, they are just paths). Once OSPF is up on the spine-to-ISN, the spines will set up MP-BGP to the CSR1Kv pair you spun up in AWS in your infra VPC.
The thing that throws me (and probably you too) is the slides you reference specifically call out "border leaf". My understanding of multisite says that cannot work. We need the spines to translate things like VNIDs and S-Class. So, maybe we dare to call that a "marketing slide" and not how you actually do it? I will ask some of my colleagues on Monday for clarity and try to add it here.
