title: Missing Authentication Token on Unauthenticated Method
body: <p>I have the following Terraform for setting up a CORS method for my API on API Gateway:</p>
  
  <pre><code>resource "aws_api_gateway_method" "default" {
    rest_api_id   = "${var.rest_api_id}"
    resource_id   = "${var.resource_id}"
    http_method   = "OPTIONS"
    authorization = "NONE"
  }
  
  resource "aws_api_gateway_method_response" "default" {
    rest_api_id = "${var.rest_api_id}"
    resource_id = "${var.resource_id}"
    http_method = "${aws_api_gateway_method.default.http_method}"
    status_code = "200"
  
    response_parameters = {
      "method.response.header.Access-Control-Allow-Headers" = true,
      "method.response.header.Access-Control-Allow-Methods" = true,
      "method.response.header.Access-Control-Allow-Origin"  = true,
    }
  }
  
  resource "aws_api_gateway_integration" "default" {
    rest_api_id          = "${var.rest_api_id}"
    resource_id          = "${var.resource_id}"
    http_method          = "${aws_api_gateway_method.default.http_method}"
    type                 = "MOCK"
    passthrough_behavior = "WHEN_NO_MATCH"
  
    request_templates {
      "application/json" = "{ \"statusCode\": 200 }"
    }
  }
  
  resource "aws_api_gateway_integration_response" "default" {
    rest_api_id = "${var.rest_api_id}"
    resource_id = "${var.resource_id}"
    http_method = "${aws_api_gateway_method.default.http_method}"
    status_code = "${aws_api_gateway_method_response.default.status_code}"
  
    response_parameters = {
      "method.response.header.Access-Control-Allow-Headers" = "'${join(",", var.allow_headers)}'",
      "method.response.header.Access-Control-Allow-Methods" = "'${join(",", var.allow_methods)}'",
      "method.response.header.Access-Control-Allow-Origin"  = "'${var.allow_origin}'",
    }
  }
  </code></pre>
  
  <p>My variables are defined as:</p>
  
  <pre><code>variable "allow_headers" {
    type = "list"
    default = ["Content-Type", "X-Amz-Date", "Authorization", "X-Api-Key", "X-Amz-Security-Token", "X-Requested-With"]
  }
  
  variable "allow_methods" {
    type = "list"
    default = ["*"]
  }
  
  variable "allow_origin" {
    default = "*"
  }
  
  variable "resource_id" {
    description = "The API Gateway Resource id."
  }
  
  variable "rest_api_id" {
    description = "The API Gateway REST API id."
  }
  </code></pre>
  
  <p>When I use the API Gateway web console to test the endpoint, it works as expected:</p>
  
  <p><a href="https://i.stack.imgur.com/TWRis.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TWRis.png" alt="enter image description here"></a></p>
  
  <p>However, when I try curl the endpoint, I get a 403:</p>
  
  <pre><code>$ curl -is -X OPTIONS https://api.naftuli.wtf/echo.json
  HTTP/1.1 403 Forbidden
  Content-Type: application/json
  Content-Length: 42
  Connection: keep-alive
  Date: Fri, 23 Feb 2018 20:45:09 GMT
  x-amzn-RequestId: 70089d6b-18da-11e8-9042-c3baac8eebde
  x-amzn-ErrorType: MissingAuthenticationTokenException
  X-Cache: Error from cloudfront
  Via: 1.1 5a582ba7fbecfc5948507c13d8d2078a.cloudfront.net (CloudFront)
  X-Amz-Cf-Id: VB2j87V6_wfSqXkyIPeqz8vjdDF5vBIi0DsJmIAn8kgyIjSAfkcf7A==
  
  {"message":"Missing Authentication Token"}
  </code></pre>
  
  <p>The method is clearly configured with <code>authorization = "NONE"</code> and I can trigger it from the API Gateway console without issue.</p>
  
  <p>How can I allow access to this method? I feel like I've done all that I can.</p>