CORS is really driving me crazy and I\'m really out of ideas as of what to try to make it work.
I have created a simple APIG Api with 1 resource cal
I was also stuck in this error, and after digging, I found that in non 2XX responses, the API was not giving Access-Control-Allow-Origin header in the response. Hence, while the OPTION method and successful (2XX) responses had this header, the 4XX and 5XX did not. One can also confirm this using PostMan and inspecting the headers of the bad response.
After tweaking with configuration I made sure to return that header in all responses.