ᐈ Simplify AWS API Gateway CORS with Terraform and Lambda

Cross-Origin Resource Sharing (CORS) plays an important role in the development of web applications as it allows clients to safely receive data from an API hosted on a different origin. In other words, the CORS meaning in API development refers to the protocol that enables web applications to interact with APIs running on different domains. AWS API Gateway simplifies API management but needs careful configuration to ensure CORS policies align with security and functionality requirements.

Below, we’ll show how to configure CORS and integrate AWS Lambda with API Gateway using Terraform, a powerful Infrastructure as Code (IaC) tool.

What is CORS in API development

The CORS mechanism works in such a way that it allows web applications to send requests to servers hosted on a different domain. For example, if your frontend is hosted on example.com and the backend API is on api.example.com, it ensures that the browser does allow these interactions.

Browsers will block requests without proper CORS configuration due to the Same-Origin Policy aiming to prevent potentially harmful cross-origin requests. Сonfiguring CORS requires setting headers, such as Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers (we will explain it in greater detail below).

Advantages of CORS

Security: CORS acts as a protective barrier because it controls which external domains can interact with your API. This restriction of unauthorized access reduces the risks of malicious requests.
Support for modern web applications: Single Page Applications (SPAs) and Progressive Web Apps (PWAs) benefit from secure and flexible data sharing, which is important for their dynamic and responsive functionality.
Flexibility: CORS gives you the possibility to customize access, i.e., you can specify methods, such as GET, POST, DELETE, as well as headers on a per-origin basis. Thus, your API will be able to meet specific use cases or security requirements.
Improved user experience: Appropriately configured CORS makes interactions between multiple domains seamless, avoiding issues with access and hence ensuring an uninterrupted user experience.
Improved developer control: Developers have fine-grained control over API access and can apply best practices for cross-origin requests without significantly changing server-side code.
Compliance with standards: Your app will comply with common web standards and be compatible with modern browsers. Using CORS ultimately reduces the effort of handling cross-domain interactions.
Debugging and monitoring: With well-defined CORS headers, debugging API-related issues is much easier, as origin/header mismatches can quickly be identified and resolved as such.

AWS API gateway CORS configuration

The AWS API Gateway managed service makes it easy to create, publish, and maintain APIs. However, enabling CORS API Gateway requires careful setup to facilitate cross-origin communications. Without the correct CORS configuration, requests might get blocked, and clients won’t be able to connect to APIs from other origins.

To ensure smooth operations, you must explicitly define which origins, methods (e.g., GET, POST), and headers are allowed in the API Gateway settings. Tools like Terraform come in handy—they help automate these configurations and simplify cloud resource deployment and management in general. Integrating AWS Lambda CORS with API Gateway will add flexibility, especially in serverless applications.

Setting up AWS API gateway with Terraform

To enable CORS on an API Gateway resource, you’ll need to define headers and methods within Terraform configurations.

Prerequisites

Before starting, ensure you have the following in place:

AWS CLI (version 2 or later) is installed and configured.
Terraform is installed on your local machine.
An AWS account with permissions for API Gateway and Lambda is available.
You understand Terraform syntax and modules, at least at a basic level.

Step 1: configure CORS on AWS API gateway

To enable CORS for an API Gateway resource, you need to define specific CORS headers in the Terraform configuration. Here’s a sample setup:

resource "aws_api_gateway_rest_api" "example_api" {
  name = "example-api"
}

resource "aws_api_gateway_resource" "example_resource" {
  rest_api_id = aws_api_gateway_rest_api.example_api.id
  parent_id   = aws_api_gateway_rest_api.example_api.root_resource_id
  path_part   = "example"
}

resource "aws_api_gateway_method" "example_method" {
  rest_api_id   = aws_api_gateway_rest_api.example_api.id
  resource_id   = aws_api_gateway_resource.example_resource.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "example_integration" {
  rest_api_id = aws_api_gateway_rest_api.example_api.id
  resource_id = aws_api_gateway_resource.example_resource.id
  http_method = aws_api_gateway_method.example_method.http_method
  type        = "MOCK"

  request_templates = {
    "application/json" = "{\"statusCode\": 200}"
  }
}

resource "aws_api_gateway_method_response" "cors_method_response" {
  rest_api_id = aws_api_gateway_rest_api.example_api.id
  resource_id = aws_api_gateway_resource.example_resource.id
  http_method = aws_api_gateway_method.example_method.http_method
  status_code = "200"

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = true
  }
}

resource "aws_api_gateway_integration_response" "cors_integration_response" {
  rest_api_id = aws_api_gateway_rest_api.example_api.id
  resource_id = aws_api_gateway_resource.example_resource.id
  http_method = aws_api_gateway_method.example_method.http_method
  status_code = aws_api_gateway_method_response.cors_method_response.status_code

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = "'*'"
  }
}

Step 2: integrate AWS Lambda with API gateway

You might also want to set integration with AWS Lambda to extend the capabilities of your API Gateway further.

Here’s how you can do that using Terraform:

resource "aws_lambda_function" "example_lambda" {
  function_name = "example_lambda"
  runtime       = "nodejs18.x"
  role          = aws_iam_role.example_lambda_role.arn
  handler       = "index.handler"

  source_code_hash = filebase64sha256("lambda.zip")
  filename         = "lambda.zip"
}

resource "aws_api_gateway_integration" "lambda_integration" {
  rest_api_id = aws_api_gateway_rest_api.example_api.id
  resource_id = aws_api_gateway_resource.example_resource.id
  http_method = aws_api_gateway_method.example_method.http_method
  integration_http_method = "POST"
  type        = "AWS_PROXY"
  uri         = aws_lambda_function.example_lambda.invoke_arn
}

Step 3: test and verify CORS

Once the resources are deployed, test the API using Postman or browser developer tools to make a request to the API. Verify for the presence of the Access-Control-Allow-Origin header in the response. When CORS has been configured correctly, cross-origin requests will be successful.

Best practices for configuring AWS API gateway with Lambda and CORS

Use specific origins by restricting access to trusted domains only instead of allowing all origins ('*').
Optimize Lambda performance by reducing cold start times and choosing appropriate runtime and memory configurations.
Automate deployments using CI/CD pipelines to automate Terraform configuration and deployment.

Simplifying API setup with CORS and Terraform

Configuring CORS on AWS API Gateway is an important step toward ensuring secure and seamless cross-origin communication for your APIs. Because CORS offers key benefits in terms of security, flexibility, and user experience, your API will be more robust and compatible with modern web applications. You can automate the complete configuration using Terraform: this will save you time and decrease the possibility of manual errors. Additionally, you can achieve flexibility in your serverless architecture by integrating AWS Lambda with API Gateway.

If you want to get more information about AWS API Gateway CORS, Terraform, and serverless solutions, check out our blog or contact us to learn how our services can help you design scalable, secure APIs customized to your application’s requirements.

Request more information today

Discover how our services can benefit your business. Leave your contact information and our team will reach out to provide you with detailed information tailored to your specific needs. Take the next step towards achieving your business goals.

Contact form:

Our latest news

All news