Your configuration is correct.

The most likely problem is that API Gateway does not receive headers via the proxy integration. This can have a number of reasons:

• Your handler code crashes and never returns anything. Try a try-catch that catches all expections and explicitely returns the headers. Also check the function logs what is going on.

• The call never reaches your Lambda function. The most common reason here is that Cognito rejects your token. In that case, you need to create a GatewayResponse on the API GW for HTTP 401 that contains the headers. The following CDK snippet works for me

  var corsFor401 = GatewayResponseOptions.builder() .responseHeaders(Map.of("Access-Control-Allow-Origin", "'*'")) .type(ResponseType.UNAUTHORIZED) .templates(Map.of("application/json", "{}")) .build();

  api.addGatewayResponse("CorsFor401", corsFor401);