The Oops thing is quite surprising - I wouldn’t have expected that to be related to Cloudfront… But if it’s fixed now… great! 
It just means “this asset is allowed to be used from a cross-site context”. You probably wouldn’t want this header on the actual forum HTTP responses. But for static assets, which don’t require authentication, and don’t include any private information, it’s totally fine. It’s exactly how the CORS system is supposed to be used - for servers to selectively control which responses should be available cross-site.
If you really wanted to, you could set Access-Control-Allow-Origin: my-forum.example.com. But then you’ll run into problems if you ever change your forum domain.