CORS Access-Control-Allow-Origin Header missing - Api Gateway HTTP / EC2

My backend setup for https://api.example.com is Route 53 -> Api Gateway HTTP API -> Cloud Map -> An EC2 instance running docker/django. When I make a fetch request from https://example.com, I get the error:

Access to fetch at 'https://api.example.com/foo' from origin 'https://www.example.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

In API Gateway I've created /{proxy+} routes for POST, GET, PATCH, OPTIONS, all with integrations to my VPC.

For the CORS settings on my Api Gateway, I've set:

• Access-Control-Allow-Origin: "*" (I'm only allowing all origins for testing purposes)
• Access-Control-Allow-Headers: "*"
• Access-Control-Allow-Method: POST, GET, PATCH, OPTIONS
• Access-Control-Expose-Headers: "*"
• Access-Control-Max-Age: 300

If I run curl http://{my-ec2-instance-public-ip}:8000/foo from my local terminal it returns the correct response, which makes me think the problem lies somewhere between API Gateway and the container.

Is there some other configuration setting I'm missing?