I use AWS Amplify, it makes all of these headaches go away and it's ridiculously simple to configure.

1. Add your domain in AWS Route 53

2. Tell it which git repo & branch you want to use (including private github ones)

3. It detects the repo contains a hugo site (works for other ssg) and generates a build script

So now every time I commit to my selected branch, Lambda is notified, it fires up a vm to generate the html, move it into S3 and takes care of Cloudfront, SSL & so on.