With the correct cache busting, files can remain cached for as long as you like. Craft handles a lot of this for you.
I typically cache items for a year but do take caution to ensure every reference to assets within the site has a cache busting string on it. It's important to note that Cloudfront needs to be setup to use these query strings.
On the frontend, Craft appends an mtime attribute to the query string. If you ever replace an asset, the mtime is updated and subsequently a new cache is created.
Within the Craft CP, thumbnails of your remote images are generated rather than serving them from a CloudFront URL, generally there are no worries with caching here as Craft handles that.
Volumes with an expiry set will automatically load the mtime parameter when fetching the URL from Craft. Alternatively, you can implement your own cache busting with the url() function shown here.
mtimeattribute should be appended when you fetch the URL from Craft. You will likely need the Base URL and CloudFront distribution ID set to the corresponding values at CloudFront for that to work. I am unable to find any documentation to support that but this answer seems to show the same thing. – Matt Banner Apr 28 '21 at 07:18image.png?mtime=1, CloudFront will cache that. If you then replace the asset within Craft, Craft will automatically adjust the value ofmtime. No cache will exist at CloudFront for the newmtimeso it will be re-fetched from the origin. – Matt Banner Apr 29 '21 at 07:35