cors_configuration | Patterned Designs Documentation

Overview

Cross-Origin Resource Sharing (CORS) configuration allows web applications in one domain to access resources in your S3 bucket from another domain.

Default Value

cors_configuration = null

Configuration Structure

cors_configuration = {
  cors_rules = [
    {
      allowed_headers = ["*"]
      allowed_methods = ["GET", "PUT", "POST"]
      allowed_origins = ["https://example.com"]
      expose_headers  = ["ETag"]
      max_age_seconds = 3600
    }
  ]
}

Parameters

Parameter	Description	Required
`allowed_headers`	Headers allowed in preflight requests	No
`allowed_methods`	HTTP methods allowed (GET, PUT, POST, DELETE, HEAD)	Yes
`allowed_origins`	Origins allowed to make requests	Yes
`expose_headers`	Headers exposed to the browser	No
`max_age_seconds`	Cache duration for preflight responses	No

Common Patterns

Static Website Assets

cors_configuration = {
  cors_rules = [{
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = ["https://www.example.com"]
    max_age_seconds = 86400
  }]
}

Direct Upload from Browser

cors_configuration = {
  cors_rules = [{
    allowed_headers = ["*"]
    allowed_methods = ["GET", "PUT", "POST"]
    allowed_origins = ["https://app.example.com"]
    expose_headers  = ["ETag", "x-amz-meta-*"]
  }]
}

Best Practices

Avoid using wildcard (*) for origins in production
Use specific allowed methods and headers
Set appropriate max_age_seconds to reduce preflight requests
Test CORS configuration thoroughly before deployment

module "s3_bucket" { source = "registry.patterneddesigns.ca/essentials/s3-bucket/aws" version = "0.1.0" # cors_configuration cors_configuration = "..." # Other required inputs bucket_name = "..." }