In testing the AWS S3 distribution with CloudFront in 3.x the internal distribution channel no longer functions. This is because using CloudFront requires setting the org.opencastproject.download.url key to your cloudfront URL. When the internal (preview) WOH fires and distributes, it (correctly) distributes to the internal download channel, however the check to see if the artifacts distributed correctly uses the download url key to find the host, and thus checks in the wrong place.
> [... ] the check to see if the artifacts distributed correctly uses the download url key to find the host, and thus checks in the wrong place.
I don't understand the problem here: In case AWS distribution is used, the 'internal' previews should be published to AWS, too. But why does that check then fail?
Note that 'internal' might be misleading: 'internal' is supposed to indicate that this publication channel is reserved for applications that are part of Opencast itself (e.g. Video Editor). To avoid undesirable dependencies of 'external' applications on content produced for those 'internal' applications, it is hidden.
This doesn't mean that those files are 'internal' to Opencast: They are very much just normal distribution artefacts as any other publication channels are. So if you use AWS distribution, you should distribute them to AWS, too.
User error. Set download url to default, and set cloudfront url in s3 config file as documented.