A single-page web application hosted on `https://app.example.com` uses JavaScript running in the browser to make PUT and GET requests directly to an S3 bucket in a different domain, `assets-bucket.s3.amazonaws.com`. The browser blocks these requests with cross-origin errors. Which S3 feature must be configured on the bucket to allow this?
- A CORS configuration on the bucket listing the allowed origin, methods, and headers
- S3 Transfer Acceleration
- S3 Object Lock in Governance mode
- A gateway VPC endpoint for S3
Why A? And why not the others?
Correct answer: A. A CORS configuration on the bucket listing the allowed origin, methods, and headers
A CORS (cross-origin resource sharing) configuration is a document attached to the bucket that identifies the origins allowed to access it, the HTTP methods supported for each origin, and other operation-specific details such as which headers a preflight request may send and which response headers a browser script may read. Without a matching CORS rule, a browser enforces same-origin policy and blocks the script's requests to the bucket's different domain, regardless of whether the underlying IAM or bucket-policy permissions would otherwise allow the call; CORS is a browser-side check layered on top of those permissions. Transfer Acceleration only speeds up long-distance uploads and downloads by routing them through CloudFront edge locations onto AWS's backbone network; it has no effect on whether a browser permits a cross-origin script request and does not address the blocking behaviour described. Object Lock in Governance mode only prevents object versions from being deleted or overwritten before a retention period expires; it has nothing to do with cross-origin browser restrictions and would not change what the browser allows. A gateway VPC endpoint for S3 only changes how traffic from within a VPC reaches S3 over the AWS network instead of the internet; it is irrelevant to a public browser making requests from a user's machine and does not configure any origin, method, or header allowances.
Source: AWS S3 documentation: Using cross-origin resource sharing (CORS) — elements of a CORS configuration (AllowedOrigins, AllowedMethods, AllowedHeaders)