I finally found the problem. The solution can be found at https://stackoverflow.com/questions/59822923/amplify-publish-causes-accessdenied-error/59839507#59839507 . It seems it has nothing to do with the region. Amplify simply seems to forget to set the “Restrict Bucket Access” flag in Cloudfront. I hope they can fix this soon — I reported it at https://github.com/aws-amplify/amplify-cli/issues/3229 .