I resolved this by using the built-in CloudFront interface.
I admit the documentation on this is pretty poor, but the aim behind it is to get people to pay for this redirection.
To have your mywebmail.mydomain.com mapped into myaws.awsapps.com/workmail then please follow the steps below:
1) You might have done this step already: On your DNS server (where that is), create a CNAME to map mywebmail.mydomain.com into myaws.awsapps.com
2) Login into your CloudFront interface https://console.aws.amazon.com/cloudfront/
3) Click on "Create Distribution"
4) On the Origin-Domain put myaws.awsapps.com
5) On the Origin-URI put /workmail
6) Adjust the setting to what you like such as redirecting from HTTP into HTTPS or use as-is etc.
7) Scroll down to the CNAME and enter the aliases you need, for this example you need to put in mywebmail.mydomain.com
8) Save
9) Notice that this might take a while to get created, mine took about 30 minutes to complete, also every time I needed to edit something it would take around 10-20 minutes to complete.
10) Once done, browse your mywebmail.mydomain.com, your CNAME on your original DNS (step 1 above) should ask your browser to redirect and then with AWS CloundFront setting it would add the URI afterwards,
11) If you get a blank page, then check your headers, in particular ( ?organization=YourDomainName ), you might need to manually add it there from the behaviours menu of the item you created above.