lambda@edge cors

  CustomResponseHeader:
    Type: AWS::Serverless::Function
    Properties:
      # FunctionName: !Sub ${AWS::StackName}-CustomResponseHeader
      Handler: index.handler
      Runtime: nodejs12.x
      AutoPublishAlias: live
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - edgelambda.amazonaws.com
            Action:
              - sts:AssumeRole
      InlineCode: |
        const addHeader = function(headers, key, value) {
          headers[key.toLowerCase()] = [{ key: key, value: value }]
        }

        exports.handler = async (event) => {
          console.log(JSON.stringify(event));
          const { response } = event.Records[0].cf;

          addHeader(response.headers, 'Strict-Transport-Security', 'max-age=300; includeSubdomains;')

          addHeader(response.headers, '')
          addHeader(response.headers)

          console.log(JSON.stringify(response))
          return response;
        }