When you sync/un-sync the media files from WordPress or update their protection status, you’ll need to remove them from CloudFront edge caches. Otherwise, your protected files will still be accessible through the CloudFront URLs
To invalidate files using the CloudFront console, please follow the below steps.
1. Sign in to the AWS Management Console and open the CloudFront console at
https://console.aws.amazon.com/cloudfront/.
2. Pick the distribution for which you want to process the invalidation

3. Choose
Invalidations tab
4. Choose
Create Invalidation
5. Key in the file paths (URL). For instance, if you want to invalidate the URL https://your-cloudfront-domain.com/your-optional-folder/wp-content/uploads/2019/05/No-one.pdf, then your pattern should be your-optional-folder/wp-content/uploads/2019/05/No-one.pdf. Optionally, you can put the * at the end of the path in order to invalidate all files under that directory, i.e.
your-optional-folder/wp-content/uploads/*.

6. Choose
Invalidate and wait till the status changing from
In Progress to
Completed.