diff --git a/serverless/aws/README.md b/serverless/aws/README.md
index 39067c8..d47892e 100644
--- a/serverless/aws/README.md
+++ b/serverless/aws/README.md
@@ -26,6 +26,7 @@ Configure these Lambda environment variables:
 * `PMTILES_PATH`: optional, define how a tileset name is translated into an S3 key. Default `{name}.pmtiles`
   * Example path setting for objects in a directory: `my_folder/{name}/file.pmtiles`
 * `TILE_PATH`: optional, define the URL route of the tiles API. Default `/{name}/{z}/{x}/{y}.pbf`
+* `CORS`: optional, set the value of the `Access-Control-Allow-Origin` response header. Examples: `https://example.com`, `*`. Only supports one origin, so useful for development or staging environments only. For production use you should use CloudFront CORS configuration.
 
 ## Test Event
 
diff --git a/serverless/aws/src/index.ts b/serverless/aws/src/index.ts
index c2139ff..e463a72 100644
--- a/serverless/aws/src/index.ts
+++ b/serverless/aws/src/index.ts
@@ -155,6 +155,10 @@ export const handler = async (
 	var headers: Headers = {};
 	// TODO: metadata and TileJSON
 
+	if (process.env.CORS) {
+		headers['Access-Control-Allow-Origin'] = process.env.CORS;
+	}
+
 	const source = new S3Source(name);
 	const p = new PMTiles(source, CACHE, nativeDecompress);
 	try {