How do you add CloudFront in front of API Gateway

API Gateway (APIG), while it uses CloudFront (CF) it does not support CDN edge caching. When I configured a CF dist to use APIG as the custom origin, I get a permission denied error.

How do I configure CF to fix this?