RefreshHit from cloudfront even with cache-control: max-age=0, no-store

Question

Cloudfront is getting a RefreshHit for a request that is not supposed to be cached at all.

It shouldn't be cached because:

1. It has cache-control: max-age=0, no-store;
2. The Minimum TTL is 0; and
3. I've created multiple invalidations (on /*) so this cached resource isn't from some historical deploy

Any idea why I'm getting RefreshHits?

I also tried modifying Cache-Control to be cache-control no-store, stale-if-error=0, creating a new invalidation on /* and now I'm seeing a cache hit (this time in Firefox):

Answer 1

It's probably too late for OP's project, but I would personally handle this with a simple origin-response Lambda@Edge function, and a single cache behavior for /* and cache policy. You can write all of the filtering/caching logic in the origin-response function. That way you only manage one bit of function code in one place, instead of a bunch of individual cache behaviors (and possibly a bunch of cache policies).

For example, an origin-response function that looks for a cache-control response header coming from your origin. If it exists, pass it back to the client. However if it doesn't exist (or if you want to overwrite it with something else) then you can create the response header there. The edge doesn't care if the cache-control header came from your origin, or from an origin-response Lambda. To the edge, it is all the same.