SMG-1185: Added CORS and NoIndexNoFollow Response Header Policies

[porhkz]

---

Description of the proposed changes

• corsAllowOrigins - Configure CORS Access-Control-Allow-Origin headers
  • Automatically applied to static file behaviors (*.js, *.css, etc.)
  • Automatically applied to remapPaths and remapBackendPaths
  • Applied to default behavior (combined with NoIndexNoFollow when applicable)
• indexable (default: true) - Control search engine indexing
  • When false, adds x-robots-tag: noindex,nofollow header to default behavior
  • Combines with CORS configuration when both are set
• corsResponseHeadersPolicy - Exposed as public property for custom downstream use

Screenshots (if applicable)
Before

export class StaticHostingStack extends Stack {
...
    const responseHeadersPolicies: ResponseHeaderMappings = {};
    responseHeadersPolicies["additionalBehaviorResponsePolicy"] = {};

    // Create CORS policy if corsAllowOrigin is specified
    let customSimpleCORSPolicy: ResponseHeadersPolicy | undefined;

    if (props.corsAllowOrigin) {
      const corsBehavior: ResponseHeadersCorsBehavior = {
        accessControlAllowCredentials: false,
        accessControlAllowHeaders: ['*'],
        accessControlAllowMethods: ['GET', 'HEAD', 'OPTIONS'],
        accessControlAllowOrigins: props.corsAllowOrigin,
        originOverride: true,
      };

      customSimpleCORSPolicy = new ResponseHeadersPolicy(this, "customSimpleCORSPolicy", {
        corsBehavior: corsBehavior
      });
    }

    // Configure default behavior response headers policy
    if (!props.indexable) {
      // Create noindex/nofollow policy with optional CORS
      responseHeadersPolicies["defaultBehaviorResponseHeaderPolicy"] =
        new ResponseHeadersPolicy(this, "NoIndexNoFollow", {
          customHeadersBehavior: {
            customHeaders: [
              {
                header: "x-robots-tag",
                value: "noindex,nofollow",
                override: true,
              },
            ],
          },
          corsBehavior: props.corsAllowOrigin ? {
            accessControlAllowCredentials: false,
            accessControlAllowHeaders: ['*'],
            accessControlAllowMethods: ['GET', 'HEAD', 'OPTIONS'],
            accessControlAllowOrigins: props.corsAllowOrigin,
            originOverride: true,
          } : undefined,
        });
    } else if (customSimpleCORSPolicy) {
      // If indexable but CORS is enabled, use CORS policy for default behavior
      responseHeadersPolicies["defaultBehaviorResponseHeaderPolicy"] = customSimpleCORSPolicy;
    }

...
// This would be repeatedly applied to every remapPath and remapBackendpath
...(customSimpleCORSPolicy && { behaviour: { responseHeadersPolicy: customSimpleCORSPolicy } }),
...

After

new StaticHosting(this, "StaticHostingStack", {
  corsAllowOrigins: props.corsAllowOrigin,
  indexable: props.indexable
}); 

Other solutions considered (if any)

• N/A

Notes to PR author

⚠️ Please make sure the changes adhere to the guidelines mentioned here

Notes to reviewers

🛈 When you've finished leaving feedback, please add a final comment to the PR tagging the author, letting them know that you have finished leaving feedback

[TheOrangePuff]

LGTM!