API Gateway CORS Configuration with CloudFormation

cors_config.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Sample CORS Configuration with CORS and API Gateway. 
  View the full post at https://broadwaylab.com/api-gateway-cors-configuration-with-cloudformation

Resources:
  # Global API
  AppApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Dev
      # enable CORS; to make more specific, change the origin wildcard
      # to a particular domain name, e.g. "'www.example.com'"
      Cors:
        AllowMethods: "'OPTIONS,GET,POST,PUT,DELETE'"
        AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key'"
        AllowOrigin: "'wwww.example.com'"
      Auth:
        DefaultAuthorizer: CognitoApiGatewayAuthorizer
        Authorizers:
          CognitoApiGatewayAuthorizer:
            UserPoolArn: 
              Fn::GetAtt:
              - CognitoUserPool
              - Arn
        # Important! Add this line, or you'll have a bad time. 
        # The CORS preflight OPTIONS request will fail. 
        AddDefaultAuthorizerToCorsPreflight: False

  # Cognito user pool. 
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties: 
      Policies:
        PasswordPolicy:
          MinimumLength: 8       

  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties: 
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref UserPoolWebClient
          ProviderName: !GetAtt CognitoUserPool.ProviderName

  UserPoolWebClient:
    Type: AWS::Cognito::UserPoolClient
    Properties: 
      UserPoolId: !Ref CognitoUserPool
      GenerateSecret: false

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  AppApi:
    Description: "API Gateway endpoint URL for the API"
    Value: !Sub "https://${AppApi}.execute-api.${AWS::Region}.amazonaws.com/Dev/"