Not exactly the perfect answer, but setting the CORS AllowedOrigins to a wildcard does work:

new Bucket(this, "MyBucket", new BucketProps()
{
    BucketName = "myBucketName",
    //....
    Cors = 
    [
        new CorsRule()
        {
            AllowedHeaders = //...
            AllowedMethods = //...
            AllowedOrigins = ["https://webapp-*.transfer-webapp.<REGION>.on.aws"]
        }
    ]
});