CORS Lockdown

After the first Terraform Terraform
HashiCorp Terraform — provisions all platform infrastructure through five modules in `terraform/`. apply, API Gateway API Gateway
Amazon API Gateway — REST API exposing `/catalog`, `/query`, and `/reprocess`. Browser CORS is locked to the Amplify hostname; CLI clients call the API Gateway URL directly. CORS defaults to permissive settings suitable for initial deployment. Lock CORS to the Amplify Amplify
AWS Amplify — hosts the Vite portal SPA. This walkthrough deploys via manual zip upload (no Git connection required). branch hostname so only the hosted portal can call the API from a browser.

Why lock down CORS

• Browser clients (the Amplify portal) require matching Access-Control-Allow-Origin
• CLI clients (curl, scripts, Postman) are unaffected — CORS is a browser-only restriction

Apply CORS lockdown

From the demo repo root:

terraform -chdir=terraform apply \
  -var="region=ap-southeast-2" \
  -var="amplify_domain=$(terraform -chdir=terraform output -raw cors_domain)"

This sets amplify_domain to the deployed Amplify branch hostname. The Query Query
Query API Lambda (`services/query-api/`) — serves `/catalog` and `/query` from processed S3 keys and Parquet/JSON files. and Reprocess API Reprocess API
Reprocess API Lambda (`services/reprocess-api/`) — accepts `/reprocess` jobs, writes DynamoDB records, enqueues Reprocess_Queue. Lambdas receive CORS_ALLOW_ORIGIN matching that hostname.

Verify CORS domain

terraform -chdir=terraform output -raw cors_domain
terraform -chdir=terraform output -raw app_url

The CORS domain should match the hostname portion of app_url.

Note

If you redeploy Amplify to a new branch hostname, re-run this apply with the updated cors_domain output.

Test browser access

1. Open app_url in a browser
2. Select a station — the catalog and query requests should succeed
3. If requests fail with CORS errors, confirm this step was applied after the first full deploy

CLI access unchanged

API Gateway URL works from curl regardless of CORS settings:

export API_URL="$(terraform -chdir=terraform output -raw api_url)"
curl "${API_URL}/catalog"

See REST API verification and REST API Usage.

Next steps

Proceed to Verification to confirm end-to-end behavior.