Take down a Terraform-managed CloudFront site without drift

To take a static S3+CloudFront site offline reversibly, disable the distribution instead of destroying it: get-distribution-config (keep the ETag), set DistributionConfig.Enabled=false, update-distribution --if-match ETAG. After it reaches Deployed (a few minutes) the alias and the *.cloudfront.net host stop resolving (curl exit 6), while the bucket, certificate and content stay. If the distribution is in Terraform, also set enabled = false in the resource on every branch you deploy from, or the next unrelated apply (e.g. an ECS image bump) silently re-enables the site.