1. Home
  2. Training Library
  3. Storage (DVA-C01)

Cross Origin Resource Sharing (CORS) with S3

Start course
Overview
Difficulty
Beginner
Duration
1h 3m
Description

This course provides detail on the AWS Storage services relevant to the Developer - Associate exam.

Want more? Try a lab playground or do a Lab Challenge!

Learning Objectives

  • An overview of Amazon S3
  • An understanding of storage classes
  • S3 versioning
  • Server-access logging
  • Object-level logging
  • Transfer Acceleration
  • Implementing access control policies
  • Cross-Origin Resource Sharing (CORS)
  • Encryption mechanisms, including:
    • SSE-S3
    • SSE-KMS
    • SSE-C
    • CSE-KSM
    • CSE-C
Transcript

Hello, and welcome to this short lecture covering Cross Origin Resource Sharing, known as CORS in Amazon S3. At a high level, CORS allows specific resources on a webpage to be requested from a different domain than its own. And this allows you to build client-side web applications. And then if required, you can utilize CORS support to access resources stored in S3.

Let's take a look at how to configure CORS for a bucket which as you might expect involves the use of policies and these policies are embedded in the CORS configuration of the bucket itself which can be found under the Permissions tab.

Let's take a look at an example which has a single rule. The following policy allows you to use PUT, POST, and DELETE from the origin of www.cloudacademy.com. The AllowedHeaders element of the policy determines which headers are allowed in a preflight request through the Access-Control-Request-Headers header, which is used by browsers to let the server know which HTTP header the client might send when the actual request is made. And in this case, all headers will be allowed to be used in a preflight request.

Using this example, when the bucket receives a preflight request from a browser, S3 will evaluate the policy associated with the bucket for its CORS configuration and will process the first matching rule in the policy. A match is made when the following conditions in the rule are met.

The requestor's Origin header matches an entry made in the AllowedOrigins element. The method used in the request, for example a POST or DELETE operation is matched in the AllowedMethods element. And finally, the headers used within the requests Access-Control-Request-Headers header with a preflight request matches a value in the AllowedHeader element.

The ExposeHeader element in the policy is used to define a header in the response that is allowed to be made by customer applications. For a full reference to the common S3 response headers, take a look at the common response headers in the S3 API Reference Guide found here.

Your CORS policy can contain more than one rule. For example, the following policy contains two rules. The first rule is the same as the one we looked at earlier and the second rule only allows PUT and POST operations following the origin of aws.com.

About the Author
Avatar
Stuart Scott
AWS Content Director
Students
187352
Labs
1
Courses
158
Learning Paths
115

Stuart has been working within the IT industry for two decades covering a huge range of topic areas and technologies, from data center and network infrastructure design, to cloud architecture and implementation.

To date, Stuart has created 150+ courses relating to Cloud reaching over 180,000 students, mostly within the AWS category and with a heavy focus on security and compliance.

Stuart is a member of the AWS Community Builders Program for his contributions towards AWS.

He is AWS certified and accredited in addition to being a published author covering topics across the AWS landscape.

In January 2016 Stuart was awarded ‘Expert of the Year Award 2015’ from Experts Exchange for his knowledge share within cloud services to the community.

Stuart enjoys writing about cloud technologies and you will find many of his articles within our blog pages.