I have configured my AWS S3 as origin for my AWS CDN. The CORS in the bucket is properly set and I am able to make XHR requests using both the S3 URL and the CDN URL. But I have a requirement to pass a custom header in xhr requests (ex: Allowed-from) and it too is working fine when using the S3 URL as well as the CDN URL. However when I add a WAF rule to allow only when the header "Allowed-from" is say "abc" then it is throwing CORS error but it is working fine when I am making a curl request.
Not sure why adding a WAF rule would throw CORS error. Below are my CORS JSON, WAF rules JSON and my CDN behavior.
