ClickOps static hosting stays calm when the edge and the bucket share one story: CloudFront owns public TLS and cache policy, the bucket stays private behind origin access, and Cache-Control on objects or a response-headers policy tells the edge what may be stored. Keep Cookie and Authorization out of the public behaviour so session noise never fans out the key. Prefer content-hashed filenames with long immutable lifetimes for assets, and a short TTL or tagged invalidation for index HTML so a deploy cannot strand viewers on a stale shell that still points at missing chunks.

Ops prove-out after wiring the distribution: fetch a hashed asset twice and expect MISS then HIT with Age climbing under a stable host-path key; fetch the HTML shell and confirm it expires or purges on deploy. After replacing an object under the same key, run a path invalidation and re-check until the old body is gone everywhere that mattered. Most bucket-updated-but-site-unchanged tickets are an un-invalidated edge object or a query variant still in the cache key, not a broken ACL.