S3 CORS Policy Generator: Create AWS Bucket CORS JSON for Browser Uploads

What is an S3 CORS policy?

An S3 CORS policy is a bucket-level rule set that tells Amazon S3 which browser origins can access objects, which HTTP methods are allowed, which request headers can be sent, and which response headers JavaScript can read. It is separate from IAM, bucket policies, ACLs, and presigned URL authorization.

S3 console JSON vs AWS CLI JSON

The S3 console commonly shows the rules themselves. The AWS CLI put-bucket-cors command expects a wrapper object with CORSRules. This small difference is easy to miss, so the generator outputs both.

[
  {
    "AllowedOrigins": ["https://app.example.com"],
    "AllowedMethods": ["GET", "PUT", "HEAD"],
    "AllowedHeaders": ["Content-Type"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

{
  "CORSRules": [
    {
      "AllowedOrigins": ["https://app.example.com"],
      "AllowedMethods": ["GET", "PUT", "HEAD"],
      "AllowedHeaders": ["Content-Type"],
      "ExposeHeaders": ["ETag"],
      "MaxAgeSeconds": 3600
    }
  ]
}

Recommended S3 CORS policies by use case

How to generate an S3 CORS policy

1. Open the S3 CORS policy generator and select AWS S3.
2. Pick a preset for public read, presigned upload, signed download, or assets.
3. Add exact origins such as https://app.example.com and http://localhost:3000.
4. Add all request headers your frontend sends.
5. Copy the policy or download the AWS CLI JSON file.
6. Apply it with aws s3api put-bucket-cors --bucket BUCKET --cors-configuration file://cors-aws-cli.json.

Common S3 CORS mistakes

• Using the wrong wrapper: AWS CLI expects CORSRules, not only a bare array.
• Forgetting localhost: your production origin does not cover local dev.
• Allowing GET but uploading with PUT: the preflight method must be allowed.
• Missing upload headers: every header in Access-Control-Request-Headers must be covered.
• Not exposing ETag: uploads may succeed, but JavaScript cannot read ETag unless it is in ExposeHeaders.

Use the debugger for failed preflight requests

Paste your current S3 CORS policy into the S3/R2 CORS debugger, then enter the browser origin, method, request headers, and console error. The debugger shows whether the request fails because of origin, method, request headers, exposed response headers, or wildcard origin with credentials.