Configuring CORS is probably the biggest pain about this approach and is necessary if you want to send data to and from an API. This guide should probably mention it or link another guide.
CORS is only needed for the API, not the website, and only if you don't control the API or don't make it so the API can be served (from the client's perspective) from the same origin, perhaps because it's fronted by the same Cloudfront distribution.
(Of course, you can rewrite the URL on the fly via Lambda@Edge but that's a PITA to maintain)