Using Heroku SSL (ACM) alongside AWS S3 / Cloudfront
No you don't have to use the same identical SSL certificate in both places. Amazon has its own ACM service (Amazon Certificate Manager). When you request a free certificate from Amazon Certificate Manager it will also automatically update the certificate, similar to Heroku's ACM service.
Enable the Heroku certificate to get SSL on the resources Heroku is serving. Then go into AWS and go to the Amazon Certificate Manager service and request a free SSL certificate there as well. Then add that Amazon certificate to your CloudFront distribution.