S3 redirection rules to exclude one folder - redirect

Question

I am trying to host a static website on S3 and Cloudfront like many others before me. I've got it mostly all set up, and have created LetsEncrypt certificates for both my naked domain (call it example.com) and www.example.com.
I have two S3 buckets, called www.example.com and example.com, and two corresponding Cloudfront distributions that simply point to their respective S3 buckets, and Route 53 is set up with two ALIAS A-records.
The example.com S3 bucket contains my website, and the www.example.com bucket is set to redirect to https://example.com.
This is working fine. However, the annoying thing is that when I need to update the LetsEncrypt certificates for both domains, I need to turn off HTTP-to-HTTPS redirect in Cloudfront, and then disable the redirect for the www.example.com S3 bucket so that the .well-known challenge can be accessed from the LetsEncrypt CA. This is annoying, as it means users hitting the www website won't get redirected to the naked domain during certificate renewal.
I was thinking of defining an S3 redirection rule on both buckets that would always redirect to https://example.com, but exclude the .well-known folder for the LE CA. This way I could let Cloudfront serve both HTTP and HTTPS, handle the redirect in S3, and LetsEncrypt renewal would be fully transparent. But this doesn't seem possible to express with the S3 routing grammar: https://docs.aws.amazon.com/AmazonS3/latest/dev/HowDoIWebsiteConfiguration.html
There doesn't seem to be a way to express an "if key prefix doesn't equal" condition, or any way to express "if condition does not match, do nothing" so any attempt at excluding a folder would seem to necessarily lead to a redirect loop.
Can someone tell me what I'm missing or if this is in fact not possible with S3? Seems too basic a feature to be missing!

Answer 1

Well, the feature is indeed missing but it should be possible all the same, because for objects that are't publicly accessible or are not present at all, the web site endpoint will want to return a 403 Forbidden response... but you can override that behavior with a routing rule, and redirect instead of returning that error.
<RoutingRules>
<RoutingRule>
<Condition>
<HttpErrorCodeReturnedEquals>403</HttpErrorCodeReturnedEquals>
</Condition>
<Redirect>
<Protocol>https</Protocol>
<HostName>www.example.com</HostName>
</Redirect>
</RoutingRule>
</RoutingRules>
Using this, any object that isn't present and readable results in a redirect, while objects that are present and publicly-readable are served normally... which is the behavior you're looking for. Be sure you don't have your bucket set to allow "Everyone" the "List" privilege.
You can also bypass the forced redirection for this specific path by creating a second cache behavior in the CloudFront distribution.
Set the Path Pattern in this new behavior to /.well-known/acme-challenge* (or whatever the appropriate pattern is) and set the Viewer Protocol Policy to HTTP and HTTPS. Then requests will forward to S3 without a forced redirect for a protocol change, but only for requests matching that path pattern.