I have a cloudfront distribution with an S3 bucket as the origin, in my cloudfront behaviour I have Response headers policy as SimpleCORS and Origin request policy as CORS-S3Origin, my S3 CORS configuration allows the domain I’m requesting from (both with www. and without), but Access-Control-Allow-Origin only returns the www. version for some reason, not letting me use the resource when I access the website without www.

Here’s how my bucket’s CORS policy looks like:

[
{
    "AllowedHeaders": [
        "*"
    ],
    "AllowedMethods": [
        "GET",
        "HEAD"
    ],
    "AllowedOrigins": [
        "https://example.com",
        "https://www.example.com"
    ],
    "ExposeHeaders": [
        "ETag"
    ],
    "MaxAgeSeconds": 3000
}

]