title: Is AWS S3 CORS policy at file level?
body: <p>I'm trying to apply a CORS policy to my S3 bucket, and what I am observing is that, if at any point of time, I modify the CORS policy, the older files that were uploaded to S3 still do not use the new CORS policy. For e.g.</p>
  
  <ol>
  <li>I created a S3 bucket "X"</li>
  <li><p>Added the following CORS policy -</p>
  
  <pre><code>&lt;CORSConfiguration&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;https://app1.example.com&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;DELETE&lt;/AllowedMethod&gt;
      &lt;ExposeHeader&gt;ETag&lt;/ExposeHeader&gt;
      &lt;ExposeHeader&gt;x-amz-meta-custom-header&lt;/ExposeHeader&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre></li>
  <li><p>Successfully uploaded a file a.jpeg from my application that is hosted on <code>https://app1.example.com</code>. I was also able to do a GET and a DELETE.</p></li>
  <li><p>Now I need to use the same S3 bucket for another one of my hosted apps, say app2. So I modified the CORS policy to - </p>
  
  <pre><code>&lt;CORSConfiguration&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;https://app1.example.com&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;DELETE&lt;/AllowedMethod&gt;
      &lt;ExposeHeader&gt;ETag&lt;/ExposeHeader&gt;
      &lt;ExposeHeader&gt;x-amz-meta-custom-header&lt;/ExposeHeader&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;https://app2.example.com&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;DELETE&lt;/AllowedMethod&gt;
      &lt;ExposeHeader&gt;ETag&lt;/ExposeHeader&gt;
      &lt;ExposeHeader&gt;x-amz-meta-custom-header&lt;/ExposeHeader&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre></li>
  <li><p>Now when I try to GET the file a.jpeg from <code>https://app2.example.com</code>, I still see the below error</p>
  
  <pre><code>XMLHttpRequest cannot load &lt;S3 URL&gt;. Origin https://app2.mydomain.com is not allowed by Access-Control-Allow-Origin.
  </code></pre></li>
  <li><p>However if I try to upload a new file b.jpeg from <code>https://app2.mydomain.com</code>, everything works as expected.</p></li>
  </ol>
  
  <p><strong>EDIT</strong></p>
  
  <p>I forgot to mention this earlier, but we have a CloudFront CDN in front of our S3 bucket, but I cannot find any config related to setting CORS policy in the Cloudfront config.</p>
  
  <p>Is there a way by which we can enforce the new CORS policy on previously uploaded files as well? Or is there some other way to make this work?</p>