S3 bug? CORS configuration is working in one bucket but not in another

Question

I have two identical buckets (I compared them with `aws cloudcontrol get-resource` command) , one for local environment and one for dev environment.

The only difference between them is CORS configuration:

The one for dev environment:
```
    'CorsConfiguration': {
        'CorsRules': [
            {
                'AllowedHeaders': ['*'],
                'AllowedMethods': ['GET', 'PUT', 'POST'],
                'AllowedOrigins': ['https://dev.mydomain.eu'],
            },
        ],
    },
```

The one for local environment:
```
    'CorsConfiguration': {
        'CorsRules': [
            {
                'AllowedHeaders': ['*'],
                'AllowedMethods': ['GET', 'PUT', 'POST'],
                'AllowedOrigins': [
                    'http://localhost:8000',
                    'http://192.168.50.106:8000',
                ],
            },
        ],
    },
```

I'm generating presigned urls on the backend side and later uploading the data from the frontend.

It is working in general, but only using one of the buckets - the one for dev environment. Its not an issue with the local environment, because if I add http://localhost:8000 to AllowedOrigins in dev bucket and hook it up in local environment, uploading works fine.

Only if I use bucket for the local environment I'm getting an error:

![Preflight Failure](/media/postImages/original/IM0iuVfgIOQneeLcCcCI7BnA)

It seems to me that for some reason preflight request fails for this bucket only. Note that the status code is 500 which doesn't seem to be valid either.

Any ideas?

Marcin · Accepted Answer

Thanks guys, I didn't touch it since I created this question and now it just works. I assume it has been a bug or a delay on AWS side. My advice to anyone having the same issue (CORS error with status 500) is unfortunately to just wait. I don't know when it started to work but I wasted a couple of hours trying to make it work.

re:Post Agent · Answer

This issue appears to be related to how your CORS configuration is being applied to the S3 buckets. The 500 error in the preflight request suggests a server-side issue rather than a simple CORS misconfiguration.

Here are a few things to check:

1. Verify that the CORS configuration has been properly applied to your local environment bucket. You can use the AWS CLI command `aws s3api get-bucket-cors --bucket your-bucket-name` to confirm the current CORS settings.

2. Make sure your CORS configuration is properly formatted. The configuration you've shared looks correct, but sometimes there can be subtle issues. For example, ensure there are no trailing commas or syntax errors.

3. Consider simplifying your CORS configuration for testing purposes. You could try using a wildcard for origins temporarily:
```
{
"AllowedHeaders": ["*"],
"AllowedMethods": ["GET", "PUT", "POST"],
"AllowedOrigins": ["*"]
}
```

4. Check if there are any bucket policies or IAM permissions that might be interfering with the CORS settings on your local environment bucket.

5. Ensure that the S3 bucket for the local environment is properly configured to handle the presigned URLs. The 500 error could indicate an issue with how the bucket processes the request.

If the issue persists after these checks, it might be worth recreating the CORS configuration from scratch for the problematic bucket, as sometimes configuration changes don't apply correctly.  
**Sources**  
[Enable email for your Amazon Connect instance - Amazon Connect](https://docs.aws.amazon.com/connect/latest/adminguide/enable-email1.html)  
[GetBucketCors - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html)  
[Amazon S3 examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_s3_code_examples.html)

Manvitha Potluri · Answer

The Real Cause (Likely):
Your local bucket’s CORS config is not actually applied or active — despite appearing correct in the AWS CLI or console.

Reapply the CORS configuration using the AWS CLI, even if it looks correct.

aws s3api put-bucket-cors --bucket your-local-bucket --cors-configuration file://cors.json

Your cors.json should look like this:
{
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["GET", "PUT", "POST"],
      "AllowedOrigins": [
        "http://localhost:8000",
        "http://192.168.50.106:8000"
      ]
    }
  ]
}

S3 has no versioning or validation for CORS configs, it’s possible for it to look correct but not actually apply until you explicitly re-save it.

**Also double-check:**
The bucket region matches what your backend uses to generate pre-signed URLs. A mismatch there can break preflight requests.

aws s3api get-bucket-location --bucket your-local-bucket

Run a quick OPTIONS test with curl to validate CORS preflight responses:

curl -i -X OPTIONS https://your-bucket.s3..amazonaws.com/your-key \
  -H "Origin: http://localhost:8000" \
  -H "Access-Control-Request-Method: PUT"

If you don’t see a proper Access-Control-Allow-Origin in the response, the config isn’t active and reapplying it usually fixes it immediately.

Gary Mclean · Answer

I kind of agree with Shajam answer.

What I do know is you may need to add OPTIONS to your cors policy for preflight checks.

SHAJAM · Answer

Since you are getting error with status code 500, I think the issue is not with CORS setting but with something else. Do you have other processing before reaching the S3 bucket?

Are both the buckets and your application in the same AWS region? Can you try generating a presigned URL with a longer expiration time to rule out timeout issues.

S3 bug? CORS configuration is working in one bucket but not in another

Add your answer

Relevant content