How to Pass Multiple URLs to AllowOrigins in CloudFormation Template

Question

I am using a CloudFormation template in YML format.

Depending on the environment, I need to be able to use different URLs for the Allowed Origins attribute of my CorsConfiguration. Ideally, I would like to use a Parameter defined like this:

  AllowedOrigins:
    Description: Allowed Origins
    Type: String
    AllowedPattern: '.+'

I have tried to pass in a delimited string (i.e. "http://localhost:4200,http://localhost:4201"), and split the values like this:

  OnboardingHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      CorsConfiguration:
        AllowOrigins: !Split [ ",", !Ref AllowedOrigins ]

The response in CloudFormation is:

Warnings found during import: CORS Scheme is malformed, ignoring. (Service: AmazonApiGatewayV2; Status Code: 400; Error Code: BadRequestException; Request ID: 21072c02-70c3-473d-9629-784005226bd4; Proxy: null) (Service: null; Status Code: 404; Error Code: BadRequestException; Request ID: null; Proxy: null)

Answer 1

This is the answer I got from AWS Support:

The Split function is for splitting strings into a list, but it is not for referencing an attribute. It is designed to be used with the Select function or other functions. So it is not a stand-alone function to be used for referencing. For this, you can use the CommaDelimitedList parameter type. You can use the CommaDelimitedList parameter type to specify multiple string values in a single parameter. Once you pass the CommaDelimitedList parameter value, you can reference it later on your template. Here is a CloudFormation template that works:

AWSTemplateFormatVersion: 2010-09-09
Transform: 'AWS::Serverless-2016-10-31'
Parameters:
 AllowedOriginsURLs:
   Type: CommaDelimitedList
   Default: 'https://example.com,https://example2.com'
   Description: Please enter your URLs
Resources:
 HttpApi:
   Type: 'AWS::Serverless::HttpApi'
   Properties:
     StageName: my-stage-name
     Tags:
       Tag: MyTag
     StageVariables:
       StageVar: Value
     CorsConfiguration:
       AllowOrigins: !Ref AllowedOriginsURLs
       AllowHeaders: [ x-apigateway-header ]
       AllowMethods: [ GET ]
       MaxAge: 600
       AllowCredentials: true

The AllowedOriginsURLs parameter is of type CommaDelimitedList, with the default being 'http://localhost:4200,http://localhost:4201'. You can change this parameter on startup, then you can reference AllowedOriginsURLs on AllowOrigins.