For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/ansible-aws-s3-bucket-with-unsecured-cors-rule.md.
A documentation index is available at /llms.txt.
S3 CORS rules must restrict allowed origins, methods, and headers to prevent unintended cross-origin access and data exfiltration. Overly permissive CORS (wildcard origins, all methods, or all headers) can allow arbitrary web pages to interact with or read bucket resources.
For Ansible resources community.aws.s3_cors and s3_cors, inspect each rules entry. allowed_origins should specify trusted origins (avoid "*" or unnecessarily broad lists). allowed_methods must not be ["*"] and should include only the HTTP verbs required by your application. allowed_headers must not be ["*"] and should be limited to the headers actually needed.
Rules with wildcard allowed_methods or allowed_headers, or with wildcard or overly broad origins are flagged. Prefer a single explicit origin or a narrowly-scoped set and the minimal set of methods and headers.
