If you inspect this page you will see that we we have two different Cloudfront URLs, so we use what I said above, two distributions, one for the normal CDN and another for S3.
The problem from the title of the OP is this: CSS come from the app and JS from S3. You need a CDN that is aware of where every single asset is coming from and can reach the necessary place or two CDNs. That is why we have two different settings after all.