Hello, and welcome to this short lecture covering Cross Origin Resource Sharing, known as CORS in Amazon S3. At a high level, CORS allows specific resources on a webpage to be requested from a different domain than its own. And this allows you to build client-side web applications. And then if required, you can utilize CORS support to access resources stored in S3.

Let's take a look at how to configure CORS for a bucket which as you might expect involves the use of policies and these policies are embedded in the CORS configuration of the bucket itself which can be found under the Permissions tab.

Let's take a look at an example which has a single rule. The following policy allows you to use PUT, POST, and DELETE from the origin of www.cloudacademy.com. The AllowedHeaders element of the policy determines which headers are allowed in a preflight request through the Access-Control-Request-Headers header, which is used by browsers to let the server know which HTTP header the client might send when the actual request is made. And in this case, all headers will be allowed to be used in a preflight request.

Using this example, when the bucket receives a preflight request from a browser, S3 will evaluate the policy associated with the bucket for its CORS configuration and will process the first matching rule in the policy. A match is made when the following conditions in the rule are met.

The requestor's Origin header matches an entry made in the AllowedOrigins element. The method used in the request, for example a POST or DELETE operation is matched in the AllowedMethods element. And finally, the headers used within the requests Access-Control-Request-Headers header with a preflight request matches a value in the AllowedHeader element.

The ExposeHeader element in the policy is used to define a header in the response that is allowed to be made by customer applications. For a full reference to the common S3 response headers, take a look at the common response headers in the S3 API Reference Guide found here.

Your CORS policy can contain more than one rule. For example, the following policy contains two rules. The first rule is the same as the one we looked at earlier and the second rule only allows PUT and POST operations following the origin of aws.com.