With the correct cache busting, files can remain cached for as long as you like. Craft handles a lot of this for you.
I typically cache items for a year but do take caution to ensure every reference to assets within the site has a cache busting string on it. It's important to note that Cloudfront needs to be setup to use these query strings.
On the frontend, Craft appends an
mtime attribute to the query string. If you ever replace an asset, the
mtime is updated and subsequently a new cache is created.
Within the Craft CP, thumbnails of your remote images are generated rather than serving them from a CloudFront URL, generally there are no worries with caching here as Craft handles that.
Volumes with an expiry set will automatically load the
mtime parameter when fetching the URL from Craft. Alternatively, you can implement your own cache busting with the
url() function shown here.