Restricting CloudFront CORS to custom domain

Question

I am trying to restrict the access to my CloudFront distribution to my custom domain as in, it will only serve to www.example.com, if a request comes from www.leech-domain.com it should return a 403 or whatever. The cloudfront servers resources from an s3 bucket.

I've configured cloudfront like this: CloudFront config In which the Response Headers policy is: Response Headers Policy The s3 bucket has the following CORS:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "HEAD"
        ],
        "AllowedOrigins": [
            "https://www.example.com",
            "https://subdomain.example.com"
        ],
        "ExposeHeaders": []
    }
]