JA EN
shiichan

Put CloudFront in Front of Lambda Web Functions! Protect with OAC, No Extra Fees

AWS What's New ★★★★ View Markdown
#aws#serverless#security

Hi everyone, it's Shii-chan! Here's CloudFront news that pairs perfectly with Lambda Web Functions!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon CloudFront now supports AWS Lambda Web Functions as an origin. You can deliver web applications built on Lambda Web Functions through CloudFront's global edge network.

Why it matters

Lambda Web Functions is a new serverless form that handles HTTP directly. When you publish an app, it helps to combine edge acceleration with protection.

What changes

Without changing application code, you get:

  • TLS termination at the edge for lower latency and faster connections
  • Caching for better performance
  • Custom domains with managed TLS certificates

Dive Deep

On the security side, origin access control (OAC) is available:

  • OAC makes your Lambda Web Function reachable only through CloudFront, so requests that bypass your protections do not reach the origin
  • CloudFront's edge network protects it from network-layer DDoS attacks
  • You can attach AWS WAF for application-layer security
  • For apps that authenticate their own users, original credentials reach the application unchanged, so existing sign-in flows keep working

You can configure this with the CloudFront console, SDK, CLI, or CloudFormation; see the CloudFront Developer Guide. It is available worldwide except in the CloudFront China region, with no additional fees.

Wrap-up

  • Lambda Web Functions can be a CloudFront origin
  • Edge TLS termination, caching, and custom domains with managed certificates
  • OAC limits access to CloudFront, and AWS WAF can be added
  • Available worldwide except CloudFront China, with no additional fees

Great for anyone who wants to publish web apps on Lambda Web Functions!

Related posts