DeleteBucketCors

DeleteBucketCors deletes a bucket's CORS configuration - every rule at once. When the aim is to change some rules and keep others, PutBucketCors with the full new set is the better fit. Saving an empty rule list in the dashboard does the same as this operation. Once the rules are gone, web pages on your websites' origins no longer get cross-origin access to the bucket from the browser. CORS rules explains how they work.

Good to know on STRG

• Changing CORS rules is the work of an access key for all buckets.
• x-amz-expected-bucket-owner is welcome and has nothing to check.
• On a public bucket, anonymous readers can still get answers carrying the old CORS headers for up to 5 minutes after the delete.

When you'd use it

• A web app that used to take uploads straight from the browser now sends them through its own server. Its deploy script deletes the bucket's CORS rules, so no web page can reach the bucket directly any more.
• A demo site has been taken down, and the bucket behind it stays on as plain storage. Deleting the CORS rules leaves it reachable by signed requests and SDKs, as before, and by no browser page.
• An agent that set up CORS rules for a short-lived preview cleans up after itself once the preview is over.

Request

DELETE /?cors HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Path-style, the same request is DELETE /my-bucket?cors on s3.eu-central-1.strg.com. The S3 API overview describes both addressing styles.

Permissions

The access key needs Manage buckets (buckets:write), a permission that belongs to keys for all buckets. A key limited to certain buckets gets 403 AccessDenied. Access keys has the details.

URI parameters

Name	Type	Required	Description
Bucket	String	Yes	The bucket whose CORS configuration is deleted.
cors	Flag	Yes	Selects the CORS subresource. Sent without a value.

Request headers

Name	Type	Required	Description
x-amz-expected-bucket-owner	String	No	Welcome, and has nothing to check: an access key only ever reaches its own account's buckets.

Request body

None.

Response

A successful delete answers 204 No Content with no body - also when the bucket had no CORS configuration, so running it twice is harmless.

On a bucket with Bucket Protection off, anonymous reads of objects stored with a Cache-Control that lets a shared cache keep them may be answered from STRG's cache, which keeps an answer for at most 5 minutes. For up to 5 minutes after the delete, such a reader can still get an answer carrying the old CORS headers. Signed requests are never answered from the cache. Anonymous reads has the details.

Response headers

Name	Description
x-amz-request-id	The request ID, for support requests.

Response body

None.

Errors

These are the errors this operation can answer, and the situation behind each.

Code	HTTP status	When
NoSuchBucket	404	The bucket does not exist, it is in a region other than the endpoint's, or your account has no storage in this endpoint's region.
AccessDenied	403	The access key lacks Manage buckets, or is limited to certain buckets.
InvalidAccessKeyId	403	The access key does not exist, has expired or been revoked, or was created so recently that it is not yet usable in this endpoint's region - a moment later it is.
SignatureDoesNotMatch	403	The request signature is wrong.
RequestTimeTooSkewed	403	The request time is more than 15 minutes from the server's.
AuthorizationHeaderMalformed	400	The signature's credential scope names a region other than the endpoint's.
SlowDown	503	Too many requests at once; a retry after the Retry-After interval goes through.
ServiceUnavailable	503	A temporary failure; a retry usually succeeds.

Differences from Amazon S3

A few things work a little differently on STRG, each listed here with what it means for your requests.

Aspect	Amazon S3	STRG
Access key scope	Any identity with s3:PutBucketCORS on the bucket	A key for all buckets holding Manage buckets
Bucket in another region	301 redirect with x-amz-bucket-region	404 NoSuchBucket. Each bucket answers on its own regional endpoint.
x-amz-expected-bucket-owner	Checked against the bucket owner	Welcome, with nothing to check: a key only ever reaches buckets of its own account
Public bucket	No response cache in front of the bucket	Anonymous readers can get answers carrying the old CORS headers for up to 5 minutes after the delete

Examples

Each example removes every CORS rule from my-bucket.

AWS CLI

aws s3api delete-bucket-cors \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1

Python (boto3)

import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

s3.delete_bucket_cors(Bucket="my-bucket")

JavaScript (AWS SDK v3)

import { DeleteBucketCorsCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

await client.send(new DeleteBucketCorsCommand({ Bucket: "my-bucket" }));

Related

• PutBucketCors
• GetBucketCors
• CORS rules
• Access keys
• S3 API overview