title: AWS API Gateway - CORS "access-control-allow-origin" - multiple entries
body: <p>I have a AWS Lambda instance that connects to a defined AWS API Gateway.  If I enable CORS and give the <code>access-control-allow-origin</code> a definition of <code>http://example.com</code>, then I am able to access the Lambda instance from <code>http://example.com</code>.  However, if I use <code>https://example.com</code>, it doesn't work.</p>
  
  <p>So in AWS, how can I define using multiple <code>access-control-allow-origin</code> values without using a wildcard?  I tried using something like <code>*.example.com</code>, but that doesn't work.</p>
  
  <p>EDIT:  If I use <code>'*'</code> as my value on the API gateway, but setup CORS rules on my S3 bucket, would that be secure?  Example for bucket rules:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
      &lt;CORSRule&gt;
          &lt;AllowedOrigin&gt;http://example.com&lt;/AllowedOrigin&gt;
          &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;PUT&lt;/AllowedMethod&gt;
          &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
          &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
      &lt;/CORSRule&gt;
      &lt;CORSRule&gt;
          &lt;AllowedOrigin&gt;https://example.com&lt;/AllowedOrigin&gt;
          &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;PUT&lt;/AllowedMethod&gt;
          &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
          &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
      &lt;/CORSRule&gt;
      &lt;CORSRule&gt;
          &lt;AllowedOrigin&gt;https://www.example.com&lt;/AllowedOrigin&gt;
          &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;PUT&lt;/AllowedMethod&gt;
          &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
          &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
      &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>