CORS Editor

The CORS view lets you view and edit the Cross-Origin Resource Sharing (CORS) policy for a bucket. CORS rules control which browser origins are allowed to make requests to your bucket — typically needed when a web app in one domain reads objects from S3 directly.

Opening the CORS editor

Click CORS in the sidebar. Select an account and bucket using the selectors at the top. S3 Manager loads the bucket’s current CORS configuration.

If the bucket has no CORS configuration, the editor starts with an empty rule list.

CORS rule fields

Each rule has the following fields:

Field	Description
Allowed methods	HTTP methods the rule permits: any combination of `GET`, `PUT`, `POST`, `DELETE`, `HEAD`
Allowed origins	Origins allowed to make cross-origin requests (e.g. `https://example.com` or `*`)
Allowed headers	Request headers the browser is permitted to send (e.g. `Content-Type`, `Authorization`)
Expose headers	Response headers that browsers are allowed to read (e.g. `ETag`, `x-amz-request-id`)
Max age (seconds)	How long browsers may cache the preflight response. Leave blank to omit.

Origins, allowed headers, and expose headers are free-form lists — enter one value per item.

Form mode

By default the editor shows each rule as a card. Within a card:

Toggle the method checkboxes to enable or disable GET, PUT, POST, DELETE, and HEAD for that rule.
Use the Allowed origins, Allowed headers, and Expose headers list editors to add or remove individual values. Each list has an Add button and a remove icon per entry.
Enter a number in Max age (seconds) to set the preflight cache duration, or leave it blank.
Click the trash icon in the card header to remove the rule.

Click + Add rule to append a new rule. New rules default to GET on * with no headers.

JSON mode

Click the JSON toggle to switch to a raw JSON editor. The editor shows the current rules serialized as a JSON array, using the S3 API field names:

[
  {
    "AllowedMethods": ["GET"],
    "AllowedOrigins": ["https://example.com"],
    "AllowedHeaders": ["Authorization"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

Edit the JSON directly. S3 Manager validates the JSON as you type and shows an error message if the structure is invalid. Switching back to Form mode is disabled while the JSON contains an error.

The required fields per rule are AllowedMethods (array of strings) and AllowedOrigins (array of strings). All other fields are optional. The optional ID field (string) is also accepted for rule identification.

Saving and clearing

Click Save to write the current rules to the bucket with PutBucketCors. A toast confirms the save.
Click Clear all to remove the entire CORS configuration from the bucket (DeleteBucketCors). A confirmation dialog is shown before the rules are deleted.