CloudFront + Lambda 関数 URL 構成でPOST/PUT リクエストを行うために Lambda@Edge でSigv4署名する

import {
  CloudFrontRequestEvent,
  CloudFrontRequestHandler,
  CloudFrontResponseCallback,
} from "aws-lambda";
import { HttpRequest } from "@aws-sdk/protocol-http";
import { parseUrl } from "@aws-sdk/url-parser";
import { SignatureV4 } from "@aws-sdk/signature-v4";
import { defaultProvider } from "@aws-sdk/credential-provider-node";
import { Sha256 } from "@aws-crypto/sha256-js";

export const handler: CloudFrontRequestHandler = async (
  event: CloudFrontRequestEvent,
  _context
) => {
  const request = event.Records[0].cf.request;
  const url = `https://${request.headers.host[0].value}${request.uri}`;

  const body = request.body?.data || "";
  // 署名時はbase64エンコードされたbodyをデコードする
  const decodedBody = Buffer.from(body, "base64").toString("utf-8");

  const parsedUrl = parseUrl(url);

  const httpRequest = new HttpRequest({
    headers: {
      host: parsedUrl.hostname || "",
      ...Object.fromEntries(
        Object.entries(request.headers)
          .filter(([k, v]) => k.toLowerCase() !== "x-forwarded-for") // x-forwarded-forはLambdaに到達するまでにCloudFrontに書き換えられる可能性があり、署名には含めない
          .map(([k, v]) => [k.toLowerCase(), v[0].value])
      ),
    },
    hostname: parsedUrl.hostname || "",
    method: request.method,
    path: parsedUrl.path,
    body: decodedBody,
  });

  const signer = new SignatureV4({
    credentials: defaultProvider(),
    region: "ap-northeast-1",
    service: "lambda",
    sha256: Sha256,
  });

  const signedRequest = await signer.sign(httpRequest);

  // 署名されたヘッダーをCloudFrontリクエストに追加
  for (const key of [
    "authorization",
    "x-amz-date",
    "x-amz-security-token",
    "x-amz-content-sha256",
  ]) {
    request.headers[key] = [{ key: key, value: signedRequest.headers[key] }];
  }

  return request;
};

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import * as lambda from "aws-cdk-lib/aws-lambda";
import { NodejsFunction } from "aws-cdk-lib/aws-lambda-nodejs";
import * as ssm from "aws-cdk-lib/aws-ssm";
import { Construct } from "constructs";

export class LambdaEdgeStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    const lambdaEdgeFunction = new NodejsFunction(this, "LambdaEdgeFunction", {
      runtime: lambda.Runtime.NODEJS_20_X,
      entry: "./lib/lambda-edge/origin-request-sigv4-signer.ts",
      handler: "handler",
      memorySize: 1769,
      timeout: cdk.Duration.seconds(5),
      role: new iam.Role(this, "LambdaEdgeFunctionRole", {
        assumedBy: new iam.CompositePrincipal(
          new iam.ServicePrincipal("lambda.amazonaws.com"),
          new iam.ServicePrincipal("edgelambda.amazonaws.com")
        ),
        managedPolicies: [
          iam.ManagedPolicy.fromAwsManagedPolicyName(
            "service-role/AWSLambdaBasicExecutionRole"
          ),
          iam.ManagedPolicy.fromAwsManagedPolicyName("AWSLambda_FullAccess"),
        ],
      }),
    });

    new ssm.StringParameter(this, `${id}-Origin-Request-Sigv4-Signer-Fn-Id`, {
      description: "The Lambda@Edge ARN for CloudFront",
      parameterName: "/LambdaFunctionUrlsSigv4SignerSample/LambdaEdgeArn",
      stringValue: lambdaEdgeFunction.currentVersion.functionArn,
      tier: ssm.ParameterTier.STANDARD,
    });
  }
}

import * as lambdaPython from "@aws-cdk/aws-lambda-python-alpha";
import * as cdk from "aws-cdk-lib";
import {
  AllowedMethods,
  CachePolicy,
  Distribution,
  HttpVersion,
  LambdaEdgeEventType,
  OriginRequestPolicy,
  PriceClass,
  ResponseHeadersPolicy,
  ViewerProtocolPolicy,
} from "aws-cdk-lib/aws-cloudfront";
import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
import {
  AwsCustomResource,
  AwsCustomResourcePolicy,
  PhysicalResourceId,
} from "aws-cdk-lib/custom-resources";
import { Construct } from "constructs";

export class ServerStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    /**
     * Lambda関数
     */
    const lambdaFunction = new cdk.aws_lambda.Function(this, "Lambda", {
      code: cdk.aws_lambda.Code.fromInline(`
def handler(_event, _context):
    return {
        'statusCode': 200,
        'body': 'Hello from Lambda!'
    }
`),
      handler: "index.handler",
      runtime: cdk.aws_lambda.Runtime.PYTHON_3_12,
      architecture: cdk.aws_lambda.Architecture.ARM_64,
      memorySize: 1769,
      timeout: cdk.Duration.minutes(15),
    });

    const lambdaFunctionUrl = lambdaFunction.addFunctionUrl({
      authType: cdk.aws_lambda.FunctionUrlAuthType.AWS_IAM,
      cors: {
        allowedMethods: [cdk.aws_lambda.HttpMethod.ALL],
        allowedOrigins: ["*"],
      },
    });

    new cdk.CfnOutput(this, "LambdaFunctionUrl", {
      value: lambdaFunctionUrl.url,
    });

    /**
     * CloudFront
     */
    const cloudFrontDistribution = new Distribution(this, "Default", {
      defaultBehavior: {
        origin: new cdk.aws_cloudfront_origins.FunctionUrlOrigin(
          lambdaFunctionUrl
        ),
        allowedMethods: AllowedMethods.ALLOW_ALL,
        cachePolicy: CachePolicy.CACHING_DISABLED,
        originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        responseHeadersPolicy: ResponseHeadersPolicy.SECURITY_HEADERS,
        edgeLambdas: [
          {
            eventType: LambdaEdgeEventType.ORIGIN_REQUEST,
            functionVersion: cdk.aws_lambda.Version.fromVersionArn(
              this,
              "OriginRequestSigv4SignerFn",
              this.getLambdaEdgeArn(
                "/LambdaFunctionUrlsSigv4SignerSample/LambdaEdgeArn"
              )
            ),
            includeBody: true,
          },
        ],
      },
      httpVersion: HttpVersion.HTTP2_AND_3,
      priceClass: PriceClass.PRICE_CLASS_200,
    });

    lambdaFunction.addPermission("AllowCloudFrontServicePrincipal", {
      principal: new cdk.aws_iam.ServicePrincipal("cloudfront.amazonaws.com"),
      action: "lambda:InvokeFunction",
      sourceArn: `arn:aws:cloudfront::${
        cdk.Stack.of(this).account
      }:distribution/${cloudFrontDistribution.distributionId}`,
    });

    new cdk.CfnOutput(this, "CloudFrontDistributionUrl", {
      value: `https://${cloudFrontDistribution.distributionDomainName}`,
    });
  }

  getLambdaEdgeArn(lambdaArnParamKey: string): string {
    const lambdaEdgeArnParameter = new AwsCustomResource(
      this,
      "LambdaEdgeCustomResource",
      {
        policy: AwsCustomResourcePolicy.fromStatements([
          new PolicyStatement({
            effect: Effect.ALLOW,
            actions: ["ssm:GetParameter*"],
            resources: [
              this.formatArn({
                service: "ssm",
                region: "us-east-1",
                resource: "*",
              }),
            ],
          }),
        ]),
        onUpdate: {
          service: "SSM",
          action: "getParameter",
          parameters: { Name: lambdaArnParamKey },
          physicalResourceId: PhysicalResourceId.of(
            `PhysicalResourceId-${Date.now()}`
          ),
          region: "us-east-1",
        },
      }
    );
    return lambdaEdgeArnParameter.getResponseField("Parameter.Value");
  }
}

# BodyなしでPOSTリクエスト
% curl -X POST https://dc1isj65gc48f.cloudfront.net

-> Hello from Lambda!

# BodyありでPOSTリクエスト
% curl -X POST https://dc1isj65gc48f.cloudfront.net \
     -H "Content-Type: application/json" \
     -d '{"test":"test"}'

-> Hello from Lambda!

% curl -X POST https://z3dtedgarwwyjccwd3oqhtnove0gevdy.lambda-url.ap-northeast-1.on.aws

-> {"Message":"Forbidden"}