First, I removed all S3 references from the web_only.yml file. I then ran a rebuild and, just to be safe, rake posts:rebake. The issues disappeared, but the images were still being served via the CDN. I restored S3, and the problem came back.
I opened AWS and took a look at the distribution settings in CloudFront. I had at least one domain there that was over three years old, and its TLD had changed. I find it remarkable that anything worked at all. I updated the settings according to CloudFront’s recommendations and also set access-control-allow-origin: * at some point (which is silly, as it makes CORS pointless). However, as I understand it, that header was already being served through CloudFront.
Just to be safe, I ran another rebuild and tested it. It didn’t help.
Since it’s possible that the cache was acting up, I invalidated /assets/* and, just to be safe, /assets/br/* as well. I ran another rebuild, and this time the issue was fixed.
Another issue was fixed as well. I had been dealing with an Oops… (error 50x) issue after rebuilds since the summer. When I open safe mode and disable themes, I can access the admin area. I have to disable multiple TCs (around 20 or more) for the forum to come back to life. Then I can enable those components, and everything works again.
So, can we conclude that everything stemmed from issues with AWS CloudFront?