CORS Configuration and Integration on AWS API Gateway Using Terraform

Cross-Origin Resource Sharing (CORS) plays a vital role in the development of web applications as it allows clients to safely receive data from an API hosted on a different origin. In other words, CORS is a protocol that enables web applications to interact with APIs running on different domains, a key aspect of API development. AWS API Gateway simplifies API management, but it requires careful configuration to ensure that CORS policies align with both security and functionality requirements.

CORS in API development

The CORS mechanism enables web applications to send requests to servers hosted on a different domain. For example, if your frontend is hosted on example.com and the backend API is on api.example.com, it ensures that the browser allowі these interactions.

Browsers will block requests without proper CORS configuration due to the Same-Origin Policy, aiming to prevent potentially harmful cross-origin requests. Сonfiguring CORS requires setting headers, such as:

• Access-Control-Allow-Origin
• Access-Control-Allow-Methods 
• Access-Control-Allow-Headers

Advantages of CORS

• Security: CORS acts as a protective barrier by controlling which external domains can interact with your API. This restriction of unauthorized access reduces the risks of malicious requests.
• Support for modern web applications: Single Page Applications (SPAs) and Progressive Web Apps (PWAs) benefit from secure and flexible data sharing, which is essential for their dynamic and responsive functionality.
• Flexibility: CORS allows you to customize access by specifying methods (e.g., GET, POST, DELETE) and headers on a per-origin basis. Thus, your API will be able to meet specific use cases or security requirements.
• Improved user experience: Appropriately configured CORS makes interactions between multiple domains seamless, avoiding issues with access and hence ensuring an uninterrupted user experience.
• Improved developer control: Developers have fine-grained control over API access and can apply best practices for cross-origin requests without significantly changing server-side code.
• Compliance with standards: Your app will comply with common web standards and be compatible with modern browsers. Using CORS ultimately reduces the effort of handling cross-domain interactions.
• Debugging and monitoring: With well-defined CORS headers, debugging API-related issues is much easier, as origin/header mismatches can quickly be identified and resolved.

AWS API gateway CORS configuration

The AWS API Gateway managed service makes it easy to create, publish, and maintain APIs. However, enabling CORS API Gateway requires careful setup to facilitate cross-origin communications. Without the correct CORS configuration, requests might get blocked, and clients won’t be able to connect to APIs from other origins.

To ensure smooth operations, you must explicitly define which origins, methods (e.g., GET, POST) and headers are allowed in the API Gateway settings. Tools like Terraform are handy. They help automate these configurations and simplify cloud resource deployment and management in general. Integrating AWS Lambda CORS with API Gateway will add flexibility, especially in serverless applications.

Setting up AWS API gateway with Terraform

To enable CORS on an API Gateway resource, you’ll need to define headers and methods within Terraform configurations.

Prerequisites

1. AWS CLI (version 2 or later) is installed and configured.
2. Terraform is installed on your local machine.
3. An AWS account with permissions for API Gateway and Lambda is available.
4. You understand Terraform syntax and modules, at least at a basic level.

Step 1: configure CORS on AWS API gateway

To enable CORS for an API Gateway resource, you need to define specific CORS headers in the Terraform configuration.

hcl
Copy
1resource "aws_api_gateway_rest_api" "example_api" {
2  name = "example-api"
3}
4
5resource "aws_api_gateway_resource" "example_resource" {
6  rest_api_id = aws_api_gateway_rest_api.example_api.id
7  parent_id   = aws_api_gateway_rest_api.example_api.root_resource_id
8  path_part   = "example"
9}
10
11resource "aws_api_gateway_method" "example_method" {
12  rest_api_id   = aws_api_gateway_rest_api.example_api.id
13  resource_id   = aws_api_gateway_resource.example_resource.id
14  http_method   = "GET"
15  authorization = "NONE"
16}
17
18resource "aws_api_gateway_integration" "example_integration" {
19  rest_api_id = aws_api_gateway_rest_api.example_api.id
20  resource_id = aws_api_gateway_resource.example_resource.id
21  http_method = aws_api_gateway_method.example_method.http_method
22  type        = "MOCK"
23
24  request_templates = {
25    "application/json" = "{\"statusCode\": 200}"
26  }
27}
28
29resource "aws_api_gateway_method_response" "cors_method_response" {
30  rest_api_id = aws_api_gateway_rest_api.example_api.id
31  resource_id = aws_api_gateway_resource.example_resource.id
32  http_method = aws_api_gateway_method.example_method.http_method
33  status_code = "200"
34
35  response_parameters = {
36    "method.response.header.Access-Control-Allow-Origin" = true
37  }
38}
39
40resource "aws_api_gateway_integration_response" "cors_integration_response" {
41  rest_api_id = aws_api_gateway_rest_api.example_api.id
42  resource_id = aws_api_gateway_resource.example_resource.id
43  http_method = aws_api_gateway_method.example_method.http_method
44  status_code = aws_api_gateway_method_response.cors_method_response.status_code
45
46  response_parameters = {
47    "method.response.header.Access-Control-Allow-Origin" = "'*'"
48  }
49}

Step 2: integrate AWS Lambda with API gateway

You might also want to set integration with AWS Lambda to extend the capabilities of your API Gateway further.

hcl
Copy
1resource "aws_lambda_function" "example_lambda" {
2  function_name = "example_lambda"
3  runtime       = "nodejs18.x"
4  role          = aws_iam_role.example_lambda_role.arn
5  handler       = "index.handler"
6
7  source_code_hash = filebase64sha256("lambda.zip")
8  filename         = "lambda.zip"
9}
10
11resource "aws_api_gateway_integration" "lambda_integration" {
12  rest_api_id = aws_api_gateway_rest_api.example_api.id
13  resource_id = aws_api_gateway_resource.example_resource.id
14  http_method = aws_api_gateway_method.example_method.http_method
15  integration_http_method = "POST"
16  type        = "AWS_PROXY"
17  uri         = aws_lambda_function.example_lambda.invoke_arn
18}

Step 3: test and verify CORS

Once the resources are deployed, test the API using Postman or browser developer tools to make a request to the API. Verify for the presence of the Access-Control-Allow-Origin header in the response. When CORS has been configured correctly, cross-origin requests will be successful.

Best practices for configuring AWS API gateway with Lambda and CORS

• Use specific origins by restricting access to trusted domains only instead of allowing all origins ('*').
• Optimize Lambda performance by reducing cold start times and choosing appropriate runtime and memory configurations.
• Automate deployments using CI/CD pipelines to automate Terraform configuration and deployment.

Simplifying API setup with CORS and Terraform

Configuring CORS on AWS API Gateway is an important step toward ensuring secure and seamless cross-origin communication for your APIs. Because CORS offers key benefits in terms of security, flexibility, and user experience, your API will be more robust and compatible with modern web applications.

You can automate the complete configuration using Terraform: this will save you time and decrease the possibility of manual errors. Additionally, you can achieve flexibility in your serverless architecture by integrating AWS Lambda with API Gateway.

If you want to get more information about AWS API Gateway CORS, Terraform, and serverless solutions, check out our blog or contact us to learn how our services can help you design scalable, secure APIs customized to your application’s requirements.