@mike Great to see your post just today. Yesterday I tried this exact steps. Creating an #S3 with public access blocked, create a #Cloudfront distribution... Create my own CNAME for a subdomain on my domain...
All good but I got "invalidToken" message when accessing a test file. I just couldn't get it working.