So I was following this tutorial..

https://dev.to/idrisrampurawala/share-your-aws-s3-private-content-with-others-without-making-it-public-4k59

At this point I incorrectly thought that the cloudfront_domain should be something like –

blahblahblah.cloudfront.net

# your cloudfront distribution domain created in step 4 of distribution creation steps
    cloudfront_domain = <your-cloudfront-distribution-domain>

But! you need to define it like

https://d2x0c blahblahblah.cloudfront.net

I ran across this tiny snippet, which clued me in to it.

https://github.com/boto/boto3/blob/develop/boto3/examples/cloudfront.rst