fix(apigateway): set passthrough behavior to avoid errors on CORS preflight requests

packages/aws-cdk-lib/aws-apigateway/lib/resource.ts

@@ -1,7 +1,7 @@
 import { Construct } from 'constructs';
 import { CfnResource, CfnResourceProps } from './apigateway.generated';
 import { Cors, CorsOptions } from './cors';
-import { Integration } from './integration';
+import { Integration, PassthroughBehavior } from './integration';
 import { MockIntegration } from './integrations';
 import { Method, MethodOptions, AuthorizationType } from './method';
 import { IRestApi, RestApi } from './restapi';
@@ -295,6 +295,7 @@ export abstract class ResourceBase extends ResourceConstruct implements IResourc
       integrationResponses: [
         { statusCode: `${statusCode}`, responseParameters: integrationResponseParams, responseTemplates: renderResponseTemplate() },
       ],
+      passthroughBehavior: PassthroughBehavior.NEVER,
     }), {
       authorizer: {
         authorizerId: '',

packages/aws-cdk-lib/aws-apigateway/test/cors.test.ts

@@ -733,4 +733,51 @@ describe('cors', () => {
       HttpMethod: 'OPTIONS',
     });
   });
+
+  test('CORS resource with passthroughBehavior set to NEVER', () => {
+    // GIVEN
+    const stack = new Stack();
+    const api = new apigw.RestApi(stack, 'api');
+    const resource = api.root.addResource('MyResource');
+
+    // WHEN
+    resource.addCorsPreflight({
+      allowOrigins: ['https://amazon.com'],
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGateway::Method', {
+      HttpMethod: 'OPTIONS',
+      ResourceId: { Ref: 'apiMyResourceD5CDB490' },
+      Integration: {
+        IntegrationResponses: [
+          {
+            ResponseParameters: {
+              'method.response.header.Access-Control-Allow-Headers': "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent'",
+              'method.response.header.Access-Control-Allow-Origin': "'https://amazon.com'",
+              'method.response.header.Vary': "'Origin'",
+              'method.response.header.Access-Control-Allow-Methods': "'OPTIONS,GET,PUT,POST,DELETE,PATCH,HEAD'",
+            },
+            StatusCode: '204',
+          },
+        ],
+        PassthroughBehavior: 'NEVER',
+        RequestTemplates: {
+          'application/json': '{ statusCode: 200 }',
+        },
+        Type: 'MOCK',
+      },
+      MethodResponses: [
+        {
+          ResponseParameters: {
+            'method.response.header.Access-Control-Allow-Headers': true,
+            'method.response.header.Access-Control-Allow-Origin': true,
+            'method.response.header.Vary': true,
+            'method.response.header.Access-Control-Allow-Methods': true,
+          },
+          StatusCode: '204',
+        },
+      ],
+    });
+  });
 });