The apex/root domains like example.com I wanted to redirect to www.example.com using cloudfront. So I set up cloudfront with the s3 bucket which had website redirect turned on, but I kept getting a 403 when going to https://example.com.
It seems that when cloudfront is set up to speak with the REST api for the bucket, it doesn’t get the redirect properly. So you have to change the origin to be the http address for the s3 bucket. Once I did that, the 403 goes away, and cloudfront serves the 301 redirect to www.example.com.