Restrict access to an AWS Lambda Web Function origin

You can use origin access control (OAC) to restrict access to an AWS Lambda Web Function origin. A Lambda Web Function provides its own regional or global HTTPS endpoint, which you use as the origin domain for your CloudFront distribution. For more information about Lambda Web Functions, see AWS Lambda Web Functions in the AWS Lambda Developer Guide.

For information about using OAC with a Lambda function URL origin, see Restrict access to an AWS Lambda function URL origin.

Prerequisites

Before you create and set up OAC, you must have a CloudFront distribution with a Lambda Web Function as the origin. The origin domain name is the hostname of the Lambda Web Function's endpoint. CloudFront identifies the endpoint type from the hostname:

Your configuration must also meet the following requirements:

Grant CloudFront permission to access the Lambda Web Function

Attach a resource-based policy to the Lambda Web Function that allows the CloudFront service principal (cloudfront.amazonaws.com) to invoke the endpoint. The IAM action for invoking an endpoint is lambda:InvokeWebFunctionEndpoint. The policy is attached to the Lambda Web Function, but each statement can scope the Resource to a specific endpoint ARN. Use a Condition element to allow CloudFront to access the endpoint only when the request is on behalf of the CloudFront distribution that contains the origin.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCloudFrontOACAccess",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "lambda:InvokeWebFunctionEndpoint",
            "Resource": "arn:aws:lambda:us-east-1:111122223333:web-function/my-function/endpoint/prod",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
                }
            }
        }
    ]
}

To attach the resource-based policy, use the put-resource-policy command with the function ARN (not an endpoint ARN):

aws lambda-web put-resource-policy \
  --resource-arn "arn:aws:lambda:us-east-1:111122223333:web-function/my-function" \
  --policy file://policy.json \
  --region us-east-1

You can review or remove the policy with the get-resource-policy and delete-resource-policy commands.

Create the origin access control

To create an origin access control (OAC), you can use the AWS Management Console, CloudFormation, the AWS CLI, or the CloudFront API.

OAC takes effect for every request only after the distribution finishes deploying. For an endpoint that spans more than one Region, the resource-based policy that you attached earlier must also finish replicating to every Region that serves the endpoint. Until both complete, some requests can receive a transient HTTP 403 response from the origin. These errors resolve automatically after the distribution finishes deploying and the policy finishes replicating.

Signing behavior

Lambda Web Function origins support only the always-amz-auth signing behavior (Always sign, preserve viewer authorization in the console). CloudFront always signs all requests that it sends to the Lambda Web Function, but it does not replace the Authorization header from the viewer request. Instead, CloudFront adds its signature in a dedicated CloudFront header and passes the viewer's Authorization header to the origin unmodified. With this behavior, your Lambda Web Function can receive the viewer's original Authorization header (for example, to perform its own authentication or authorization). CloudFront still signs every request that it sends to the origin. To forward the viewer's Authorization header, you must add it to a cache policy for every cache behavior that uses the origin.

The other signing behaviors (always, never, and no-override) are not supported for Lambda Web Function origins. The always-amz-auth signing behavior is not supported for any other origin type, including Lambda function URL origins.

For PUT, POST, and PATCH requests, CloudFront signs the origin request with an unsigned payload (UNSIGNED-PAYLOAD). The request body is not covered by the CloudFront signature. The signature still covers the request method, path, query string, and the headers that identify your distribution. The endpoint can therefore verify that each request comes from CloudFront on behalf of your distribution before it invokes your Lambda Web Function. The request body is protected in transit by the HTTPS connection between CloudFront and the endpoint. You do not need to include an x-amz-content-sha256 header in requests to CloudFront. If a viewer sends one, CloudFront does not use it when signing the origin request.