Understanding Cloudfront CDN behavior w/ Whitenoise, Django, Route 53

I have a (fairly standard) setup with Django, Whitenoise, Cloudfront, and Route 53 (so I can have a CName of the form cdn.offerletter.io pointing to the relevant Cloudfront distribution, which fronts a Whitenoise + basic Django app).

I've been running production settings in my local dev environment, since my CI / testing setup isn't quite "ideal". But, it wasn't working as expected locally, even though it seemed to be working in production.

Long story short, the behavior I was (apparently) observing was that if a file exists in Cloudfront already, I can retrieve it fine with the cdn.offerletter.io URL from my local development environment (which is basic/obvious).

But I can't "push" to it from my development environment, so if I activated my production settings file locally:

• existing images could be pulled from the CDN
• new / non-existent images couldn't be pushed

• even seemingly preexisting CSS files (!!)) seemed not to be able to be pulled properly from the CDN. This was extremely confusing

• Is this behavior expected? Was I seeing something else?

• At which layer is "only-push-from-originating-domain" enforced?
• Is there a quick/useful primer on deeper CDN design / protocols/ rationale out there? I'd love to read it!

tl;dr works in production, not in development.

Thanks!