[fallenhitokiri]

Both problems you mentioned are solved by using S3 configured to serve the buckets contents as static site as origin for CloudFront.

While it’s not strictly CloudFront only doing the work, it’s still a static site.

[flother]

Ah, that explains it. I store my websites in private S3 buckets, and give CloudFront access using an IAM policy. I must need to jump through extra hoops because of that.