Ensure CORS is configured to allow only trusted clients for Azure Healthcare Service

Misconfigured CORS may lead to excessive access of resources to existing clients. It may even expose private endpoints/data to unauthorized/malicious clients.

In Azure Console -

1. Open the Azure Portal and go to Health Data Services.
2. Select the Workspace that contains the service you wish to edit.
3. Under Services, choose the service you wish to edit.
4. Under Settings, select CORS.
5. Configure as needed.

In Terraform -

1. In the azurerm_healthcare_service resource, create a cors_configuration block.
2. Add/configure allowed_origins, allowed_headers, and allowed_methods as needed.

References:
https://learn.microsoft.com/en-us/azure/healthcare-apis/
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/healthcare_service#cors_configuration