S3 Bucket not setting "access-control-allow-origin" header.

Question

Hi, I set up my bucket CORS policy as following:

```
[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "HEAD"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": [
            "Access-Control-Allow-Origin"
        ]
    }
]
```

But, when I check which headers are set on the image served from the bucket I can see that it is missing. Below are the only headers I can see set on the object. I do not use cloudfront.

```
accept-ranges: bytes
content-length: 66314
content-type: image/png
date: Thu, 15 Aug 2024 06:48:54 GMT
etag: "26b4fa32a20b0425c6c47688b917b5bd"
last-modified: Wed, 20 Mar 2024 23:35:58 GMT
server: AmazonS3
x-amz-id-2: yKXSiiohdEUHbeDkOjIcd6xSdH/wS5zju6cwLepX7D1dlGykl+3k0kZ3y8IL594nyGaNBH3daVA=
x-amz-request-id: HYGVXWA1X4KSHHJG
x-amz-server-side-encryption: AES256
x-amz-version-id: uDbtLJyP6EOSpIlkHWTpfuTZBk.FbzBr
```
For completeness this is the bucket policy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::bucket/*"
        },
        {
            "Sid": "PublicRead",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::bucket/*"
        }
    ]
}
```

Any idea what might be an issue ?

Riku_Kobayashi · Accepted Answer

Hello.

Have you tried accessing from the origin as described in the documentation below?  
If you are using the "curl" command, try accessing by setting the origin domain in the header with the "-H" option.  
https://repost.aws/knowledge-center/s3-configure-cors  
```
curl -i http://mycorsbucket.s3.amazonaws.com/index.html -H "Origin: http://www.example.com"
```

S3 Bucket not setting "access-control-allow-origin" header.

Add your answer

Relevant content