I'd make one minor addition-- once the CloudFront distribution is set up, enable a bucket policy that locks the S3 bucket down to only permits CloudFront access

I'd make one minor addition-- once the CloudFront distribution is set up, enable a bucket policy that locks the S3 bucket down to only permits CloudFront access. No point in leaving the S3 bucket open to the world...