A browser SPA on https://app.example.com calls an API Gateway REST API — preflight OPTIONS requests fail and calls get blocked. What's the fix?
A.Add an IAM policy allowing the browser origin
IAM can't grant browser-origin permission — CORS isn't an IAM concept.
B.Enable CORS on the API — respond to OPTIONS with Access-Control-Allow-Origin/Headers/Methods
Correct. Configure CORS headers on the API for the SPA origin.
C.Disable CORS in the browser
Users can't be asked to weaken their browser security.
D.Move the API behind a NAT gateway
NAT handles outbound connectivity — nothing to do with CORS.
Why this answer
CORS is a browser-enforced policy: the API must answer OPTIONS preflights with the right Access-Control-* headers for the SPA's origin. It's configured on the API resource — not in IAM, not in the browser, and unrelated to NAT.
Correct answer: B · Last reviewed 2026-10-28
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security