# WebFunctionProps

Properties for defining a `WebFunction`.

Extends: WebFunctionProps
Used as props by: WebFunction

- Source: [`aws-lambda/lib/webfunction.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-lambda/lib/webfunction.ts#L72)
- Type last changed: v2.276.0 · 10 Nov 2026

## Example

```ts
import * as s3 from 'aws-cdk-lib/aws-s3';

declare const codeBucket: s3.IBucket;

new lambda.WebFunction(this, 'PerRegionApi', {
  code: lambda.WebFunctionCode.fromBucket(codeBucket, 'app.zip', 'version-id'),
  runtime: lambda.WebFunctionRuntime.NODEJS_24_X,
  defaultEndpointAuth: lambda.WebFunctionAuthType.IAM_AUTH,
  defaultEndpoint: {
    endpointLocation: lambda.WebFunctionEndpointLocation.perRegion(['us-east-1', 'us-west-2']),
  },
});
```

## Properties

- `applicationLogLevel`: [ApplicationLogLevel](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ApplicationLogLevel.html) — The minimum log level for application logs (logs emitted by your code, e.g. `console.log()`, `console.warn()`). Only logs at this level or above will be captured in CloudWatch.

  **Default:** No application log level filtering.

  For example, setting this to `INFO` will capture `console.info()` and
  `console.warn()` but filter out `console.debug()`.

- `code`: [WebFunctionCode](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionCode.html) (required) — The deployment package for the WebFunction.

- `defaultEndpoint`: [WebFunctionDefaultEndpointOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionDefaultEndpointOptions.html) — The other settings of the endpoint the WebFunction creates, `endpoint`.

  **Default:** a home-Region endpoint named `prod`, with no description and no scaling or rate limit beyond your account's quotas

  Endpoints added with `addEndpoint()` take their own settings, auth type included.

- `defaultEndpointAuth`: [WebFunctionAuthType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionAuthType.html) (required) — The authentication type of the endpoint the WebFunction creates, `endpoint`.

  There is no default: you must choose explicitly so an endpoint is never accidentally public or
  accidentally locked down. Specify `WebFunctionAuthType.IAM_AUTH` (Lambda authorizes requests with SigV4/IAM)
  or `WebFunctionAuthType.APPLICATION_MANAGED` (the endpoint is public and your function handles authorization).

  With `IAM_AUTH`, requests must be signed with SigV4 and carry the `X-Amz-Content-SHA256`
  header, also for a request without a body; without it the endpoint returns 403 even for a
  valid signature. A `MULTI_REGION` endpoint is signed with SigV4a, for the Region set `*`.

- `egressNetworkConnector`: [INetworkConnector](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.INetworkConnector.html) — The network connector that gives the function egress into a VPC.

  **Default:** no VPC egress

  The revision pins to the connector's latest version at the time it is created. For a
  connector defined in the same stack, every update to the connector therefore replaces the
  revision as part of that deployment, and traffic moves to the new version with it. To hold
  the function on a fixed version instead — or to use a connector from another stack, whose
  changing version cannot be exported — import the version with
  `NetworkConnector.fromNetworkConnectorVersionArn()`.

  The connector must have been created for `NetworkConnectorComputeType.WEB_FUNCTION`, and
  the endpoint must be `WebFunctionEndpointType.HOME_REGION`.

  The full `INetworkConnector` is required (rather than a ref) because the revision pins to
  `latestVersionArn`, which `INetworkConnectorRef` does not carry.

  [disable-awslint:prefer-ref-interface]

- `entryPoint`: string — The entry file the runtime executes, relative to the root of the deployment package.

  **Default:** the runtime's default entry point, `index.js`

  Only supported for Node.js runtimes. When set, it is passed to the runtime via the reserved
  `AWS_LAMBDA_NODEJS_ENTRYPOINT` environment variable. Do not set that
  variable through `environment` as well.

- `environment`: { [key: string]: string } — Key-value pairs of environment variables to pass to the WebFunction.

  **Default:** No environment variables.

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The KMS key used to encrypt environment variables.

  **Default:** AWS managed key.

  The Lambda service principal is granted the key usage it needs to encrypt
  and decrypt the revision's environment variables.

- `logGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — The CloudWatch log group to send logs to.

  **Default:** A log group is created, named by CloudFormation and retained when the stack is deleted. Read its name from the `logGroup` attribute.

- `maxConcurrencyPerEnvironment`: number — The maximum number of concurrent requests handled by a single execution environment.

  **Default:** the service default of 64 is applied

  Must be an integer between 1 and 128. When omitted, nothing is sent and the service
  applies its default.

- `revisionDescription`: string — A description of the WebFunction revision.

  **Default:** No description.

  Must be 256 characters or fewer.

- `role`: any — The IAM execution role for the WebFunction.

  **Default:** A new role with `AWSLambdaBasicExecutionRole` is created.

- `runtime`: [WebFunctionRuntime](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionRuntime.html) (required) — The runtime environment for the WebFunction.

- `systemLogLevel`: [SystemLogLevel](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.SystemLogLevel.html) — The minimum log level for system logs (logs emitted by the Lambda runtime, e.g. start/end/report lines and runtime errors). Only logs at this level or above will be captured in CloudWatch.

  **Default:** No system log level filtering.

- `tags`: { [key: string]: string } — Tags to apply to the WebFunction.

  **Default:** No tags.

  Only the WebFunction resource carries tags. Its revision and endpoint are not
  taggable, so nothing is applied to them.

- `timeout`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.seconds(30) — The function execution time (in seconds) after which the WebFunction is terminated.

  Must be an integer between 3 and 900 seconds.

- `webFunctionName`: string — The name of the WebFunction.

  **Default:** A unique name is generated by CDK.

  Must be 2 to 64 characters of letters, numbers, hyphens or underscores, starting and
  ending with a letter or number.