We ran into the same issue. HTTPS streams would play fine from S3, but same files didn't work through cloudfront. I know its been >3 years, but I figured I would post my findings in case someone else comes across this. It appears that Roku firmware versions < 7.0 do not support Server Name Identification (SNI) for https. Once we enabled a setting to use dedicated IPs through cloudfrount (extra monthly fee), we were able to successfully play the videos.