By default, CloudFront distribution URLs (eg. https://d2kl2vxl3xne45.cloudfront.net) are publicly accessible. So if you are using CloudFront to serve a static website out of S3, for example, then your site shall also be accessible via the CF URL as well as any custom domain you are using. If you are using Signed URLs or Signed Cookies to restrict access to your content then this is not an issue, but if you are serving your content publicly then it might bother you.
I am not sure if CloudFront URLs are easily discoverable (probably not) but if we want to ensure that our web application cannot be accessed via the CF URL then we need to block access to it.
AWS Docs Tutorial: Create a simple function with CloudFront Functions
WAF - an alternative solution may be to use AWS WAF custom rules (assuming you are using WAF that is). You would also only probably want to explore this option if you are using WAF at the C