Access Denied when creating CloudFront invalidation with AWS CLI

I'm using the AWS CLI to create a CloudFront distribution in a script:

aws configure set preview.cloudfront true
aws cloudfront create-invalidation --distribution-id ABCD1234 --paths '/*'

I have a policy set up with this statement:

{
    "Sid": "xxx",
    "Effect": "Allow",
    "Action": [
        "cloudfront:CreateInvalidation"
    ],
    "Resource": [
        "arn:aws:cloudfront::xxx:distribution/ABCD1234"
    ]
}

The policy is attached to the user that is running the command. However, I still get this error:

A client error (AccessDenied) occurred when calling the CreateInvalidation operation: User: arn:aws:iam::xxx:user/yyy is not authorized to perform: cloudfront:CreateInvalidation