It looks like this might have been a bug with earlier versions of Paperclip (I'm on 2.7) as it works on future versions.
For reference this is how I got it working. In the after_update on my model I force refreshed the instance as follows:
image.instance_write(:updated_at, Time.now.utc)
self.send(:update_without_callbacks)
I had to do update_without_callbacks
so that it wouldn't get stuck in an infinite loop in the callback.
Now the updated_at
time on the Attachment is updated, forcing refresh on Cloudfront.