Thanks guys! As in 2022, it’s still a lifesaver to add a headers property to the returned object:
return {
statusCode: 200,
headers: {
"Access-Control-Allow-Origin": "*",
"Content-Type": "application/json",
},
body: JSON.stringify(json),
};