To the school firewall, this looks like legitimate AWS traffic. Billions of legitimate business requests flow through CloudFront every second. Blocking all *.cloudfront.net domains would break half the internet for the school, including many educational tools, software updates, and image hosts.
One network administrator we spoke to anonymously put it bluntly: cloudfront unblocked games
Game on.
Some aggressive schools attempt to block *.cloudfront.net . This lasts about one day until the principal's Zoom webinar fails to load images, or the math department's Khan Academy videos stop playing. The block is reversed. To the school firewall, this looks like legitimate