When I use the cloudfront invalidate, I have noticed that it is using the credentials as set in my environment variables rather than using the credentials specified in serverless's configuration.
This is not normally an issue for CI/CD since it likely already is setup with the environment variables, however when different developers in a team are testing it out, they may not necessarily have cloudfront invalidate permissions on their own AWS keys.
I will submit a PR to fix this issue