aws-sdk-go: PUT: CloudFront-hosted S3 buckets return "The request signature we calculated does not match the signature you provided."

When PUT’ing to a CloudFront-hosted S3 bucket with authentication, it fails with The request signature we calculated does not match the signature you provided.

package main

import (
    "fmt"
    "github.com/aws/aws-sdk-go/aws"
    "github.com/aws/aws-sdk-go/aws/credentials"
    "github.com/aws/aws-sdk-go/aws/session"
    "github.com/aws/aws-sdk-go/service/s3"
    "strings"
)

func main() {
    awsConfig := &aws.Config{
        Region:      aws.String("us-east-1"),
        Credentials: credentials.NewEnvCredentials(),
    }

    awsConfig.Endpoint = aws.String("https://cloudfront.net")

    sess := session.New(awsConfig)
    client := s3.New(sess, awsConfig)

    putObject, err := client.PutObject(&s3.PutObjectInput{
        Bucket: aws.String("dy5fxXX7XXXX"),
        Key:    aws.String("foo"),
        Body:   strings.NewReader("bar"),
    })

    if err != nil {
        panic(err.Error())
    }
    fmt.Printf("%#v", putObject)
}

Output:

panic: SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
        status code: 403, request id:

We set up our CloudFront distribution to forward all query params and whitelisted headers. If we temporarily allow anonymous users to PUT objects, the uploads succeeds when we change credentials.NewEnvCredentials() to credentials.AnonymousCredentials. The upload also succeeds with credentials if we specify the real bucket name rather than going through CloudFront.