CloudFormation で Lambda Web Functions を CloudFront OAC の背後に置いてみた

AWSTemplateFormatVersion: '2010-09-09'
Description: Step 1 - S3 bucket for Lambda Web Function code (versioning + bucket policy for Lambda)

Resources:
  CodeBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  CodeBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CodeBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaWebFunctionCodeAccess
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - s3:GetObject
              - s3:GetObjectVersion
            Resource: !Sub ${CodeBucket.Arn}/*
            Condition:
              ArnLike:
                aws:SourceArn: !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:web-function/*

Outputs:
  CodeBucketName:
    Value: !Ref CodeBucket

// Minimal AWS Lambda Web Function HTTP server.
//
// You can replace this with any code or framework that starts an HTTP server.
import http from 'node:http';

// Lambda sends requests to port 3000. Set LOCAL_PORT for local development.
const port = Number(process.env.LOCAL_PORT ?? 3000);

const server = http.createServer((req, res) => {
  res.writeHead(200, { 'content-type': 'application/json' });
  res.end(JSON.stringify({ message: 'Hello from Lambda Web!', path: req.url }));
});

server.listen(port, () => {
  console.log(`listening on port ${port}`);
});

{
  "type": "module",
  "main": "index.js"
}

AWSTemplateFormatVersion: '2010-09-09'
Description: Step 3 - Lambda Web Function (IamAuth) behind CloudFront with OAC

Parameters:
  FunctionName:
    Type: String
    Default: hello-web
  CodeBucket:
    Type: String
    Description: Bucket created in step 1
  CodeKey:
    Type: String
    Default: app/hello-web.zip
    Description: Key of the .zip uploaded in step 2

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  WebFunction:
    Type: AWS::Lambda::WebFunction
    Properties:
      FunctionName: !Ref FunctionName

  Revision:
    Type: AWS::Lambda::WebFunctionRevision
    Properties:
      FunctionName: !Ref WebFunction
      BuildConfig:
        CodeConfig:
          S3Object:
            Bucket: !Ref CodeBucket
            Key: !Ref CodeKey
        RuntimeConfig:
          Runtime: nodejs24.x
      ServiceConfig:
        ExecutionRoleArn: !GetAtt ExecutionRole.Arn
        TimeoutSeconds: 30

  Endpoint:
    Type: AWS::Lambda::WebFunctionEndpoint
    Properties:
      FunctionName: !Ref WebFunction
      EndpointName: main
      EndpointType: HomeRegion
      AuthType: IamAuth
      RevisionWeights:
        - RevisionId: !GetAtt Revision.RevisionId
          Weight: 100

  Oac:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: !Sub ${FunctionName}-oac
        OriginAccessControlOriginType: lambda
        SigningBehavior: always-amz-auth
        SigningProtocol: sigv4

  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: !Ref FunctionName
        Origins:
          - Id: web-function
            DomainName: !GetAtt Endpoint.DomainName
            OriginAccessControlId: !GetAtt Oac.Id
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: web-function
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods: [GET, HEAD]
          # Managed-CachingDisabled
          CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
          # Managed-AllViewerExceptHostHeader
          OriginRequestPolicyId: b689b0a8-53d0-40ab-baf2-68738e2966ac

  ResourcePolicy:
    Type: AWS::Lambda::ResourcePolicy
    Properties:
      ResourceArn: !GetAtt WebFunction.FunctionArn
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowCloudFrontOACAccess
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: lambda:InvokeWebFunctionEndpoint
            Resource: !GetAtt Endpoint.EndpointArn
            Condition:
              StringEquals:
                aws:SourceArn: !Sub arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${Distribution}

Outputs:
  DistributionDomain:
    Value: !GetAtt Distribution.DomainName
  EndpointDomain:
    Value: !GetAtt Endpoint.DomainName