Fix CORS bug

terraform/modules/apigw/main.tf

@@ -21,14 +21,21 @@ resource "aws_api_gateway_method" "this" {
   authorization = "NONE"
 }
 
+resource "aws_api_gateway_method" "options" {
+  rest_api_id   = aws_api_gateway_rest_api.this.id
+  resource_id   = aws_api_gateway_resource.this.id
+  http_method   = "OPTIONS"
+  authorization = "NONE"
+}
+
 resource "aws_api_gateway_integration" "this" {
   rest_api_id             = aws_api_gateway_rest_api.this.id
   resource_id             = aws_api_gateway_resource.this.id
   http_method             = aws_api_gateway_method.this.http_method
   integration_http_method = "POST"
-  type = "AWS"
+  type                    = "AWS"
-  credentials = var.role_arn
+  credentials             = var.role_arn
-  uri         = var.sqs_arn
+  uri                     = var.sqs_arn
 
   request_parameters = {
     "integration.request.header.Content-Type" = "'application/x-www-form-urlencoded'"
@@ -52,6 +59,27 @@ Action=SendMessage&MessageBody={
 }
 EOF
   }
+
+  depends_on = [aws_api_gateway_method.options]
+}
+
+resource "aws_api_gateway_integration" "options" {
+  rest_api_id             = aws_api_gateway_rest_api.this.id
+  resource_id             = aws_api_gateway_resource.this.id
+  http_method             = aws_api_gateway_method.options.http_method
+  # integration_http_method = "OPTIONS"
+  type                    = "MOCK"
+
+  request_parameters = {}
+  request_templates = {
+    "application/json" = jsonencode(
+      {
+        statusCode = 200
+      }
+    )
+  }
+
+  depends_on = [aws_api_gateway_method.options]
 }
 
 resource "aws_api_gateway_deployment" "this" {
@@ -61,13 +89,22 @@ resource "aws_api_gateway_deployment" "this" {
     redeployment = sha1(jsonencode([
       aws_api_gateway_resource.this.id,
       aws_api_gateway_method.this.id,
+      aws_api_gateway_method.options.id,
       aws_api_gateway_integration.this.id,
+      aws_api_gateway_integration.options.id,
     ]))
   }
 
   lifecycle {
     create_before_destroy = true
   }
+
+  depends_on = [
+    aws_api_gateway_integration.options,
+    aws_api_gateway_integration.this,
+    aws_api_gateway_method.options,
+    aws_api_gateway_method.this
+  ]
 }
 
 resource "aws_api_gateway_stage" "this" {
@@ -81,6 +118,30 @@ resource "aws_api_gateway_method_response" "http200" {
   resource_id = aws_api_gateway_resource.this.id
   http_method = aws_api_gateway_method.this.http_method
   status_code = 200
+
+  response_parameters = {
+    "method.response.header.Access-Control-Allow-Origin" = "false"
+  }
+
+  depends_on = [aws_api_gateway_method.this]
+}
+
+resource "aws_api_gateway_method_response" "options200" {
+  rest_api_id = aws_api_gateway_rest_api.this.id
+  resource_id = aws_api_gateway_resource.this.id
+  http_method = aws_api_gateway_method.options.http_method
+  status_code = 200
+  response_models = {
+    "application/json" = "Empty"
+  }
+
+  response_parameters = {
+    "method.response.header.Access-Control-Allow-Headers" = false,
+    "method.response.header.Access-Control-Allow-Methods" = false,
+    "method.response.header.Access-Control-Allow-Origin"  = false
+  }
+
+  depends_on = [aws_api_gateway_method.options]
 }
 
 resource "aws_api_gateway_integration_response" "http200" {
@@ -89,4 +150,23 @@ resource "aws_api_gateway_integration_response" "http200" {
   http_method       = aws_api_gateway_method.this.http_method
   status_code       = aws_api_gateway_method_response.http200.status_code
   selection_pattern = "^2[0-9][0-9]"
+  response_parameters = {
+    "method.response.header.Access-Control-Allow-Origin" = "'*'"
+  }
+
+  depends_on = [aws_api_gateway_method_response.http200]
+}
+
+resource "aws_api_gateway_integration_response" "options200" {
+  rest_api_id = aws_api_gateway_rest_api.this.id
+  resource_id = aws_api_gateway_resource.this.id
+  http_method = aws_api_gateway_method.options.http_method
+  status_code = aws_api_gateway_method_response.http200.status_code
+  response_parameters = {
+    "method.response.header.Access-Control-Allow-Headers" = "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'",
+    "method.response.header.Access-Control-Allow-Methods" = "'OPTIONS,POST'",
+    "method.response.header.Access-Control-Allow-Origin"  = "'*'"
+  }
+
+  depends_on = [aws_api_gateway_method_response.options200]
 }