I’m serving static content from an S3 bucket via a signed url from Cloudfront that is redirected from my REST API using a 301. I’m trying to retrieve that content via my frontend web app and I’m running into CORS issues related to missing access-control-* headers in my GET request for the asset.

When making a request the initial OPTIONS request returns the expected headers:

Status: 200
access-control-allow-credentials: true
access-control-allow-headers: x-client-version
access-control-allow-methods: GET, HEAD
access-control-allow-origin: https://subdomain.version_number.domain.extension
access-control-expose-headers: Access-Control-Allow-Origin

However the following GET request is missing any of the same Access-Control-Allow-Credentials, Access-Control-Allow-Headers etc are completely missing from the GET request and the console shows:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [signed_url] (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

Cloudfront behaviour settings

I’ve configured the Cloudfront distribution using the following:

Origin and origin groups: my_s3_bucket
Viewer protocol policy: HTTPS only
Allowed HTTP Methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE
Restrict viewer access: Yes -> trusted key group assigned to the bucket

Cache key and origin requests policies

Origin request Policy

Response headers policy

The S3 bucket CORS config is set to:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "HEAD"
        ],
        "AllowedOrigins": [
            "https://subdomain.version_number.domain.extension"
        ],
        "ExposeHeaders": [
            "Access-Control-Allow-Origin"
        ]
    }
]

Cloudfront -> Bucket access policy

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity[ID]"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::MY_STATIC_RESOURCES/*"
        }
    ]
}