An unauthenticated static website (www.example.com) hosted on Amazon S3 and delivered via CloudFront uses AWS WAF. The site includes a registration form that calls an Amazon API Gateway endpoint, which invokes a Lambda function that forwards data to an external API. During testing, the submission triggers a CORS error. The CloudFront origin is configured to include an Access-Control-Allow-Origin header set to www.example.com. What should the solutions architect do to fix the CORS error?

The CORS error occurs because the browser is preventing a cross-origin request from the static website (www.example.com) to the API Gateway endpoint. To resolve this, the API Gateway itself must be configured to include the Access-Control-Allow-Origin header in its responses, specifying www.example.com as an allowed origin. This signals to the browser that requests from www.example.com are permitted. Modifying the S3 bucket CORS configuration is incorrect because the S3 bucket is hosting the static content, not the API endpoint that is causing the CORS error. AWS WAF is a web application firewall and does not handle CORS headers; its purpose is to filter malicious traffic. Enabling CORS in the Lambda function is incorrect because the CORS handshake happens between the browser and the API Gateway, not directly with the Lambda function. While the Lambda function's response might eventually contain CORS headers if passed through, the API Gateway is the correct place to configure this at the API level.