Cloudfront distribution not respecting cache-control header - amazon-web-services

Question

My Cloudfront distribution is aggressively caching my index.html file on the initial GET request. While I use versioned file names for all other files, I want the freshest index.html on every request. The origin is an S3 bucket and I upload my file using the --cache-control flag:
aws s3 cp index.html s3://buck/index.html --cache-control "max-age=0"
When the above was not working, I tried:
aws s3 cp index.html s3://buck/index.html --cache-control "no-store"
I have verified that the headers are set on the S3 object:
> aws s3api head-object --bucket buck --key index.html
{
"AcceptRanges": "bytes",
"LastModified": "Tue, 31 Mar 2020 14:10:40 GMT",
"ContentLength": 3265,
"ETag": "",
"CacheControl": "no-store",
"ContentType": "text/html",
"Metadata": {}
}
What smells is that after I change the cache control to no-store, the response headers in the browser still show cache-control: max-age=0. I also see x-cache: Miss from cloudfront but I guess that would be expected? Opening the site in a private window shows the correct response header.
My CacheBehaviors for the distribution are:
{
"Quantity": 1,
"Items": [
{
"PathPattern": "index.html",
"TargetOriginId": "hostingS3Bucket",
"ForwardedValues": {
"QueryString": false,
"Cookies": {
"Forward": "none"
},
"Headers": {
"Quantity": 0
},
"QueryStringCacheKeys": {
"Quantity": 0
}
},
"TrustedSigners": {
"Enabled": false,
"Quantity": 0
},
"ViewerProtocolPolicy": "redirect-to-https",
"MinTTL": 0,
"AllowedMethods": {
"Quantity": 2,
"Items": [
"HEAD",
"GET"
],
"CachedMethods": {
"Quantity": 2,
"Items": [
"HEAD",
"GET"
]
}
},
"SmoothStreaming": false,
"DefaultTTL": 0,
"MaxTTL": 0,
"Compress": true,
"LambdaFunctionAssociations": {
"Quantity": 0
},
"FieldLevelEncryptionId": ""
}
]
}
Going by the aws cloudfront docs it seems like CloudFront and browsers should respect the headers when origin adds Cache-Control: no-store. I'm not sure what I am doing wrong. Do I have to invalidate the cache? I would like to understand this behavior so I can update my site in a predictable way.