[@aws-cdk/aws-s3] More than one CORS origin not applied correctly

The allowedOrigins property passed into an addCorsRule call is not behaving as expected.

The following code:

const bucket = new Bucket(/*...*/);
bucket.addCorsRule({
  allowedMethods: [HttpMethods.GET, HttpMethods.HEAD],
  allowedOrigins: [`https://${domainName}`, `https://www.${domainName}`] // Note, two origins are passed in accordance to the docs.
});

Generates the following S3 config:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>https://baseline.dev</AllowedOrigin>
    <AllowedOrigin>https://www.baseline.dev</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>HEAD</AllowedMethod>
</CORSRule>
</CORSConfiguration>

When requesting the object, only the first origin is passed in the header:

access-control-allow-origin: https://baseline.dev

According to the docs, there should one CORSRule per origin. So the CDK should generate two rules or only allow a string, not an array of origins.

Separating into two addCoresRule calls fixes the underlying issue in the meantime.

Environment

• CLI Version : v1.62.0
• Framework Version: v1.62.0

---

This is 🐛 Bug Report

[iliapolo]

This might be an issue with the underlying CFN resource because the CDK simply mirrors it.

Marking in any case because it can be mitigated by CDK regardless.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.