aws cloudfront permissions

Question

I'm trying to allow a group i defined to have invalidation privliges

I defined a policy on the group that looks like this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1511787279000",
            "Effect": "Allow",
            "Action": [
                "cloudfront:CreateInvalidation",
                "cloudfront:ListInvalidations"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

ultimately i'd like to lock the resource down to specific Cloudfront arns. but even at this point it doesn't work. when i use the aws cli tool i get

An error occurred (AccessDenied) when calling the CreateInvalidation operation: User: arn:aws:iam::5555555555:user/username is not authorized to perform: cloudfront:CreateInvalidation

What am i doing wrong?