My custom origin returns a response that can vary on the request's protocol. The site needs some urls to be available over http, so I cannot just disable http in Cloudfront.
However, Cloudfront is caching the http response and serving it for requests made via https.
I am confused by this behavior because http://example.com is a different resource than https://example.com - so they should not be served the same cached response. However, Cloudfront seems to do this.
Is there a way to instruct Cloudfront to use the request protocol in its cache key?
No, the request protocol is not currently supported in the cache key. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-understand-cache-policy