Serve a Lambda Web Function only through a CloudFront distribution: an IamAuth endpoint, an OAC that signs origin requests, and a resource policy that trusts one distribution.
This pattern deploys a plain Node.js HTTP server as an AWS Lambda Web Function and puts an Amazon CloudFront distribution in front of it. The function's endpoint uses the
IamAuth authentication type, so Lambda accepts only requests signed with AWS Signature Version 4 and returns 403 to everything else before your code runs.CloudFront signs each origin request through an Origin Access Control of type
lambda with SigningBehavior: always-amz-auth. A resource policy on the function allows lambda:InvokeWebFunctionEndpoint for the CloudFront service principal only when AWS:SourceArn matches your distribution, so a different distribution using the same origin is also denied.After validating the signature, Lambda removes the Authorization header it used and forwards the viewer's own headers, so the application has no authentication code of its own and existing sign-in flows keep working. The app returns
Cache-Control headers that CloudFront honours, which the pattern uses to show edge caching.With CloudFront in front you can add a custom domain, AWS WAF, compression and caching to a Web Function without changing the application.
< Back to all patterns
AWS Top Pick
Variants
This pattern is available in the following frameworks/languages:
AWS CDK:Node.js
AWS CLI:Node.js
AWS SAM:Node.js
Clone repo
git clone https://github.com/aws-samples/serverless-patterns/cd serverless-patterns/lambda-web-cloudfront-oac/nodejs/samDeploy
Create a versioning-enabled S3 bucket whose policy lets lambda.amazonaws.com read objects, zip <code>src/</code> and upload it, then run <code>sam deploy --stack-name lambda-web-cloudfront-oac-sam --capabilities CAPABILITY_IAM --s3-bucket <bucket> --parameter-overrides CodeBucket=<bucket> CodeKey=<key></code>.One template creates the Web Function with an <code>IamAuth</code> endpoint, the OAC, a cache policy that forwards the viewer's Authorization header, the CloudFront distribution and the resource policy; see the GitHub repo for the bucket setup.Testing
See the GitHub repo for detailed testing instructions.
Cleanup
Delete the stack with
sam delete --stack-name lambda-web-cloudfront-oac-sam. CloudFormation disables and removes the distribution, the cache policy, the OAC and the function with its endpoint and resource policy.See the GitHub repo for removing the log groups and the code bucket.
Created by:
