WebFunctionProps Struct Added in v2.276.0
Properties for defining a WebFunction.
Example
import * as s3 from 'aws-cdk-lib/aws-s3';
declare const codeBucket: s3.IBucket;
new lambda.WebFunction(this, 'PerRegionApi', {
code: lambda.WebFunctionCode.fromBucket(codeBucket, 'app.zip', 'version-id'),
runtime: lambda.WebFunctionRuntime.NODEJS_24_X,
defaultEndpointAuth: lambda.WebFunctionAuthType.IAM_AUTH,
defaultEndpoint: {
endpointLocation: lambda.WebFunctionEndpointLocation.perRegion(['us-east-1', 'us-west-2']),
},
});
Properties
applicationLogLeveloptionalApplicationLogLevelapplication_log_leveloptionalApplicationLogLevelapplicationLogLeveloptionalApplicationLogLevelApplicationLogLeveloptionalApplicationLogLevelApplicationLogLeveloptionalApplicationLogLevel#Default: No application log level filtering.
For example, setting this to INFO will capture console.info() and console.warn() but filter out console.debug().
codeWebFunctionCodecodeWebFunctionCodecodeWebFunctionCodeCodeWebFunctionCodeCodeWebFunctionCoderequired#defaultEndpointoptionalWebFunctionDefaultEndpointOptionsdefault_endpointoptionalWebFunctionDefaultEndpointOptionsdefaultEndpointoptionalWebFunctionDefaultEndpointOptionsDefaultEndpointoptionalWebFunctionDefaultEndpointOptionsDefaultEndpointoptionalWebFunctionDefaultEndpointOptions#Default: a home-Region endpoint named prod, with no description and no scaling or rate limit beyond your account's quotas
Endpoints added with addEndpoint() take their own settings, auth type included.
defaultEndpointAuthWebFunctionAuthTypedefault_endpoint_authWebFunctionAuthTypedefaultEndpointAuthWebFunctionAuthTypeDefaultEndpointAuthWebFunctionAuthTypeDefaultEndpointAuthWebFunctionAuthTyperequired#notes
There is no default: you must choose explicitly so an endpoint is never accidentally public or accidentally locked down. Specify WebFunctionAuthType.IAM_AUTH (Lambda authorizes requests with SigV4/IAM) or WebFunctionAuthType.APPLICATION_MANAGED (the endpoint is public and your function handles authorization).
With IAM_AUTH, requests must be signed with SigV4 and carry the X-Amz-Content-SHA256 header, also for a request without a body; without it the endpoint returns 403 even for a valid signature. A MULTI_REGION endpoint is signed with SigV4a, for the Region set *.
egressNetworkConnectoroptionalINetworkConnectoregress_network_connectoroptionalINetworkConnectoregressNetworkConnectoroptionalINetworkConnectorEgressNetworkConnectoroptionalINetworkConnectorEgressNetworkConnectoroptionalINetworkConnector#Default: no VPC egress
notes
The revision pins to the connector's latest version at the time it is created. For a connector defined in the same stack, every update to the connector therefore replaces the revision as part of that deployment, and traffic moves to the new version with it. To hold the function on a fixed version instead — or to use a connector from another stack, whose changing version cannot be exported — import the version with NetworkConnector.fromNetworkConnectorVersionArn().
The connector must have been created for NetworkConnectorComputeType.WEB_FUNCTION, and the endpoint must be WebFunctionEndpointType.HOME_REGION.
The full INetworkConnector is required (rather than a ref) because the revision pins to latestVersionArn, which INetworkConnectorRef does not carry.
[disable-awslint:prefer-ref-interface]
entryPointoptionalstringentry_pointoptionalstrentryPointoptionalStringEntryPointoptionalstringEntryPointoptional*string#Default: the runtime's default entry point, index.js
Only supported for Node.js runtimes. When set, it is passed to the runtime via the reserved AWS_LAMBDA_NODEJS_ENTRYPOINT environment variable. Do not set that variable through environment as well.
environmentoptional{ [key: string]: string }environmentoptionaltyping.Mapping[str, str]environmentoptionalMap<String, String>EnvironmentoptionalIDictionary<string, string>Environmentoptional*map[string]*string#Default: No environment variables.
kmsKeyoptionalIKeyRefkms_keyoptionalIKeyRefkmsKeyoptionalIKeyRefKmsKeyoptionalIKeyRefKmsKeyoptionalIKeyRef#Default: AWS managed key.
The Lambda service principal is granted the key usage it needs to encrypt and decrypt the revision's environment variables.
logGroupoptionalILogGroupReflog_groupoptionalILogGroupReflogGroupoptionalILogGroupRefLogGroupoptionalILogGroupRefLogGroupoptionalILogGroupRef#Default: A log group is created, named by CloudFormation and retained when the stack is deleted. Read its name from the logGroup attribute.
maxConcurrencyPerEnvironmentoptionalnumbermax_concurrency_per_environmentoptionalint | floatmaxConcurrencyPerEnvironmentoptionalNumberMaxConcurrencyPerEnvironmentoptionaldoubleMaxConcurrencyPerEnvironmentoptional*float64#Default: the service default of 64 is applied
Must be an integer between 1 and 128. When omitted, nothing is sent and the service applies its default.
revisionDescriptionoptionalstringrevision_descriptionoptionalstrrevisionDescriptionoptionalStringRevisionDescriptionoptionalstringRevisionDescriptionoptional*string#Default: No description.
Must be 256 characters or fewer.
Default: A new role with AWSLambdaBasicExecutionRole is created.
runtimeWebFunctionRuntimeruntimeWebFunctionRuntimeruntimeWebFunctionRuntimeRuntimeWebFunctionRuntimeRuntimeWebFunctionRuntimerequired#systemLogLeveloptionalSystemLogLevelsystem_log_leveloptionalSystemLogLevelsystemLogLeveloptionalSystemLogLevelSystemLogLeveloptionalSystemLogLevelSystemLogLeveloptionalSystemLogLevel#Default: No system log level filtering.
tagsoptional{ [key: string]: string }tagsoptionaltyping.Mapping[str, str]tagsoptionalMap<String, String>TagsoptionalIDictionary<string, string>Tagsoptional*map[string]*string#Default: No tags.
Only the WebFunction resource carries tags. Its revision and endpoint are not taggable, so nothing is applied to them.
timeoutoptionalDurationtimeoutoptionalDurationtimeoutoptionalDurationTimeoutoptionalDurationTimeoutoptionalDuration= Duration.seconds(30)#Must be an integer between 3 and 900 seconds.
webFunctionNameoptionalstringweb_function_nameoptionalstrwebFunctionNameoptionalStringWebFunctionNameoptionalstringWebFunctionNameoptional*string#Default: A unique name is generated by CDK.
Must be 2 to 64 characters of letters, numbers, hyphens or underscores, starting and ending with a letter or number.