[PRME-253] Add missing production logic to CORS policy on S3 buckets (#408)

adamwhitingnhs · web-flow · commit 2ea83a6e1be1 · 2025-09-03T15:36:41.000+01:00
diff --git a/infrastructure/buckets.tf b/infrastructure/buckets.tf
@@ -18,13 +18,13 @@ module "ndr-document-store" {
     {
       allowed_headers = ["*"]
       allowed_methods = ["POST", "PUT", "DELETE"]
-      allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
       expose_headers  = ["ETag"]
       max_age_seconds = 3000
     },
     {
       allowed_methods = ["GET"]
-      allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
@@ -105,13 +105,13 @@ module "ndr-bulk-staging-store" {
     {
       allowed_headers = ["*"]
       allowed_methods = ["POST", "PUT", "DELETE"]
-      allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
       expose_headers  = ["ETag"]
       max_age_seconds = 3000
     },
     {
       allowed_methods = ["GET"]
-      allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }

Original file line number	Diff line number	Diff line change
`@@ -18,13 +18,13 @@ module "ndr-document-store" {`
`18`	`18`	`{`
`19`	`19`	`allowed_headers = ["*"]`
`20`	`20`	`allowed_methods = ["POST", "PUT", "DELETE"]`
`21`		`- allowed_origins = ["https://${terraform.workspace}.${var.domain}"]`
	`21`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`22`	`22`	`expose_headers = ["ETag"]`
`23`	`23`	`max_age_seconds = 3000`
`24`	`24`	`},`
`25`	`25`	`{`
`26`	`26`	`allowed_methods = ["GET"]`
`27`		`- allowed_origins = ["https://${terraform.workspace}.${var.domain}"]`
	`27`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`28`	`28`	`}`
`29`	`29`	`]`
`30`	`30`	`}`
`@@ -105,13 +105,13 @@ module "ndr-bulk-staging-store" {`
`105`	`105`	`{`
`106`	`106`	`allowed_headers = ["*"]`
`107`	`107`	`allowed_methods = ["POST", "PUT", "DELETE"]`
`108`		`- allowed_origins = ["https://${terraform.workspace}.${var.domain}"]`
	`108`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`109`	`109`	`expose_headers = ["ETag"]`
`110`	`110`	`max_age_seconds = 3000`
`111`	`111`	`},`
`112`	`112`	`{`
`113`	`113`	`allowed_methods = ["GET"]`
`114`		`- allowed_origins = ["https://${terraform.workspace}.${var.domain}"]`
	`114`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`115`	`115`	`}`
`116`	`116`	`]`
`117`	`117`	`}`