AWS CDKでCloudFrontのLambda Function URLsへのOACを設定してみた

    // Lambda Function
    const wasshoiLambda = new cdk.aws_lambda_nodejs.NodejsFunction(
      this,
      "WasshoiLambda",
      {
        entry: path.join(__dirname, "../src/lambda/wasshoi/index.ts"),
        runtime: cdk.aws_lambda.Runtime.NODEJS_20_X,
        bundling: {
          minify: true,
          tsconfig: path.join(__dirname, "../src/lambda/tsconfig.json"),
          format: cdk.aws_lambda_nodejs.OutputFormat.ESM,
        },
        architecture: cdk.aws_lambda.Architecture.ARM_64,
        loggingFormat: cdk.aws_lambda.LoggingFormat.JSON,
      }
    );

    // CloudFront Distribution
    this.distribution = new cdk.aws_cloudfront.Distribution(this, "Default", {
      defaultBehavior: {
        origin: new cdk.aws_cloudfront_origins.FunctionUrlOrigin(
          wasshoiLambda.addFunctionUrl({
            authType: cdk.aws_lambda.FunctionUrlAuthType.AWS_IAM,
          })
        ),
        allowedMethods: cdk.aws_cloudfront.AllowedMethods.ALLOW_GET_HEAD,
        cachedMethods: cdk.aws_cloudfront.CachedMethods.CACHE_GET_HEAD,
        cachePolicy: new cdk.aws_cloudfront.CachePolicy(this, "WasshoiCache", {
          minTtl: cdk.Duration.seconds(1),
          maxTtl: cdk.Duration.seconds(31536000),
          defaultTtl: cdk.Duration.seconds(86400),
          enableAcceptEncodingBrotli: true,
          enableAcceptEncodingGzip: true,
          queryStringBehavior:
            cdk.aws_cloudfront.CacheQueryStringBehavior.allowList("wasshoi"),
        }),
        viewerProtocolPolicy:
          cdk.aws_cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        responseHeadersPolicy:
          cdk.aws_cloudfront.ResponseHeadersPolicy.SECURITY_HEADERS,
      },
      httpVersion: cdk.aws_cloudfront.HttpVersion.HTTP2_AND_3,
      priceClass: cdk.aws_cloudfront.PriceClass.PRICE_CLASS_200,
      domainNames: props.domainName ? [props.domainName] : undefined,
      certificate: props.domainName
        ? props.certificateConstruct?.certificate
        : undefined,
      logBucket: props.cloudFrontAccessLogBucketConstruct?.bucket,
      logFilePrefix: props.logFilePrefix,
    });

    // OAC
    const cfnOriginAccessControl =
      new cdk.aws_cloudfront.CfnOriginAccessControl(
        this,
        "OriginAccessControl",
        {
          originAccessControlConfig: {
            name: "Origin Access Control for Lambda Functions URL",
            originAccessControlOriginType: "lambda",
            signingBehavior: "always",
            signingProtocol: "sigv4",
          },
        }
      );

    const cfnDistribution = this.distribution.node
      .defaultChild as cdk.aws_cloudfront.CfnDistribution;

    // Set OAC
    cfnDistribution.addPropertyOverride(
      "DistributionConfig.Origins.0.OriginAccessControlId",
      cfnOriginAccessControl.attrId
    );

    // Add permission Lambda Function URLs 
    wasshoiLambda.addPermission("AllowCloudFrontServicePrincipal", {
      principal: new cdk.aws_iam.ServicePrincipal("cloudfront.amazonaws.com"),
      action: "lambda:InvokeFunctionUrl",
      sourceArn: `arn:aws:cloudfront::${
        cdk.Stack.of(this).account
      }:distribution/${this.distribution.distributionId}`,
    });

import { Callback, LambdaFunctionURLEvent, Context } from "aws-lambda";

export const handler = async (
  event: LambdaFunctionURLEvent,
  context: Context,
  callback: Callback
) => {
  const wasshoi = Math.round(Number(event.queryStringParameters?.wasshoi || 0));

  const message =
    !Number.isInteger(wasshoi) || wasshoi <= 0
      ? "わっしょい! したくないのですか ... ?"
      : wasshoi >= 10
      ? "お静かに"
      : Array(wasshoi).fill("わっしょい!!").join(" ");

  return {
    statusCode: 200,
    headers: { "Content-Type": "text/plain" },
    body: JSON.stringify({
      message,
    }),
  };
};

export const lambdaOacStackProperty: LambdaOacStackProperty = {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  },
  props: {
    hostedZone: {
      zoneName: "lambda-url.non-97.net",
    },
    certificate: {
      certificateDomainName: "lambda-url.non-97.net",
    },
    contentsDelivery: {
      domainName: "lambda-url.non-97.net",
    },
    allowDeleteBucketAndObjects: true,
    cloudFrontAccessLog: {
      enableAccessLog: true,
      lifecycleRules: [{ expirationDays: 365 }],
    },
    logAnalytics: {
      createWorkGroup: true,
      enableLogAnalytics: ["cloudFrontAccessLog"],
    },
  },
};

$ curl "https://lambda-url.non-97.net/?wasshoi=1"
{"message":"わっしょい!!"}

$ curl "https://lambda-url.non-97.net/?wasshoi=2"
{"message":"わっしょい!! わっしょい!!"}

$ curl "https://lambda-url.non-97.net/"
{"message":"わっしょい! したくないのですか ... ?"}

$ curl "https://lambda-url.non-97.net/?wasshoi=-1"
{"message":"わっしょい! したくないのですか ... ?"}

$ curl "https://lambda-url.non-97.net/?wasshoi=a"
{"message":"わっしょい! したくないのですか ... ?"}

$ curl "https://lambda-url.non-97.net/?wasshoi=8"
{"message":"わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!!"}

$ curl "https://lambda-url.non-97.net/?wasshoi=10"
{"message":"お静かに"}

$ curl "https://lambda-url.non-97.net/?wasshoi=5.1"
{"message":"わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!!"}

$ curl "https://lambda-url.non-97.net/?wasshoi=5.5"
{"message":"わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!! わっしょい!!"}