Tutorial: Create a basic Lambda@Edge function

Create an Amazon S3 bucket with a file or two, such as image files, for sample content. For help, follow the steps in Upload your content to Amazon S3. Make sure that you set permissions to grant public read access to the objects in your bucket.

Create a CloudFront distribution and add your S3 bucket as an origin, by following the steps in Create a CloudFront web distribution. If you already have a distribution, you can add the bucket as an origin for that distribution instead.

Sign in to the AWS Management Console and open the AWS Lambda console at https://console.aws.amazon.com/lambda/.

Choose Create function.

On the Create function page, choose Use a blueprint, and then filter for the CloudFront blueprints by entering cloudfront in the search field.

Choose the Modify HTTP response header blueprint as the template for your function.

Enter the following information about your function:

Choose Create function at the bottom of the page.

In the Deploy to Lambda@Edge pane that appears, choose Cancel. (For this tutorial, you must modify the function code before deploying the function to Lambda@Edge.)

Scroll down to the Code source section of the page.

Replace the template code with a function that modifies the security headers that your origin returns. For example, you could use code similar to the following:

'use strict';
export const handler = (event, context, callback) => {

    //Get contents of response
    const response = event.Records[0].cf.response;
    const headers = response.headers;

    //Set new headers
    headers['strict-transport-security'] = [{key: 'Strict-Transport-Security', value: 'max-age= 63072000; includeSubdomains; preload'}];
    headers['content-security-policy'] = [{key: 'Content-Security-Policy', value: "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'"}];
    headers['x-content-type-options'] = [{key: 'X-Content-Type-Options', value: 'nosniff'}];
    headers['x-frame-options'] = [{key: 'X-Frame-Options', value: 'DENY'}];
    headers['x-xss-protection'] = [{key: 'X-XSS-Protection', value: '1; mode=block'}];
    headers['referrer-policy'] = [{key: 'Referrer-Policy', value: 'same-origin'}];

    //Return modified response
    callback(null, response);
};

Choose File, Save to save your updated code.

Choose Deploy.

In the Lambda console, on the Function overview page for your function, choose Add trigger.

For Trigger configuration, choose CloudFront.

Choose Deploy to Lambda@Edge.

In the Deploy to Lambda@Edge pane, under Configure CloudFront trigger, enter the following information:

Select the Confirm deploy to Lambda@Edge check box.

Choose Deploy to add the trigger and replicate the function to AWS locations worldwide.

Wait for the function to replicate. This typically takes several minutes.

You can check to see if replication is finished by going to the CloudFront console and viewing your distribution. Wait for the distribution status to change from Deploying to a date and time, which means that your function has been replicated. To verify that the function works, follow the steps in the next section.

In a browser, enter the URL for a file in your S3 bucket. For example, you might use a URL similar to https://d111111abcdef8.cloudfront.net/image.jpg.

For more information about the CloudFront domain name to use in the file URL, see Customize the URL format for files in CloudFront.

Open your browser's Web Developer toolbar. For example, in your browser window in Chrome, open the context (right-click) menu, and then choose Inspect.

Choose the Network tab.

Reload the page to view your image, and then choose an HTTP request on the left pane. You see the HTTP headers displayed in a separate pane.

Look through the list of HTTP headers to verify that the expected security headers are included in the list. For example, you might see headers similar to those shown in the following screenshot.

Sign in to the AWS Management Console and open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.

Change Region to the location that is shown when you view the file in your browser. This is where the function is executing.

In the left pane, choose Logs to view the logs for your distribution.

Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

Select your bucket, and then choose Properties.

From Properties, choose Logging.

Clear the Enabled check box.

Choose Save.

Open the CloudFront console at https://console.aws.amazon.com/cloudfront/v4/home.

Select the distribution that you want to disable, and then choose Disable.

When prompted for confirmation, choose Yes, Disable.

Select the disabled distribution, and then choose Delete.

When prompted for confirmation, choose Yes, Delete.