MultiRegion な Lambda Web Functions を OAC 付きの CloudFront で公開する構成を試してみた

import * as cdk from 'aws-cdk-lib';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
import { Construct } from 'constructs';

const CACHING_DISABLED = '4135ea2d-6df8-44a3-9df3-4b5a84be39ad'; // Managed-CachingDisabled
const ALL_VIEWER_EXCEPT_HOST = 'b689b0a8-53d0-40ab-baf2-68738e2966ac'; // Managed-AllViewerExceptHostHeader

// One Web Function (IamAuth) with a MultiRegion endpoint (Tokyo + Virginia) and a PerRegion endpoint, behind CloudFront (OAC).
//   Origin group. primary = global endpoint (sigv4a OAC), secondary = Virginia regional endpoint (sigv4 OAC). Fails over on 500/502/503/504.
//   Global only. global endpoint only (no origin group).
// The app (app-fail/) answers 503 in Tokyo during a time window baked in at build time, or waits and then answers 200 during the window.
export class FoCfStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);
    const regions = ['ap-northeast-1', 'us-east-1'];
    const codeBucket = new s3.Bucket(this, 'CodeBucket', {
      versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
    });
    codeBucket.addToResourcePolicy(new iam.PolicyStatement({
      principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
      actions: ['s3:GetObject', 's3:GetObjectVersion'],
      resources: [codeBucket.arnForObjects('*')],
      conditions: { ArnLike: { 'aws:SourceArn': `arn:${this.partition}:lambda:${this.region}:${this.account}:web-function/*` } },
    }));
    const execRole = new iam.Role(this, 'ExecRole', {
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')],
    });
    const deployment = new s3deploy.BucketDeployment(this, 'Code', {
      sources: [s3deploy.Source.asset('app-fail')], destinationBucket: codeBucket, extract: false, prune: false,
    });
    const fn = new lambda.CfnWebFunction(this, 'Fn', { functionName: 'webfn-fo-cf' });
    const revision = new lambda.CfnWebFunctionRevision(this, 'Revision', {
      functionName: fn.ref,
      buildConfig: {
        codeConfig: { s3Object: {
          bucket: codeBucket.bucketName,
          key: cdk.Fn.select(0, deployment.objectKeys),
          versionId: cdk.Fn.select(0, deployment.objectVersionIds),
        } },
        runtimeConfig: { runtime: 'nodejs24.x' },
      },
      serviceConfig: { executionRoleArn: execRole.roleArn, timeoutSeconds: 30 },
    });
    revision.node.addDependency(codeBucket.policy!);
    const mk = (eid: string, name: string, type: 'MultiRegion' | 'PerRegion') => new lambda.CfnWebFunctionEndpoint(this, eid, {
      functionName: fn.ref, endpointName: name, endpointType: type, regions, authType: 'IamAuth',
      revisionWeights: [{ revisionId: revision.attrRevisionId, weight: 100 }],
    });
    const global = mk('EndpointGlobal', 'global', 'MultiRegion');
    const regional = mk('EndpointRegional', 'regional', 'PerRegion');
    regional.addDependency(global); // create one after the other
    const virginiaDomain = cdk.Fn.getAtt(regional.logicalId, 'RegionalEndpoints.us-east-1.DomainName').toString();

    const oac = (oid: string, proto: string) => new cloudfront.CfnOriginAccessControl(this, oid, {
      originAccessControlConfig: {
        name: `${this.stackName}-${proto}`, originAccessControlOriginType: 'lambda',
        signingBehavior: 'always-amz-auth', signingProtocol: proto,
      },
    });
    const oacV4a = oac('OacSigv4a', 'sigv4a');
    const oacV4 = oac('OacSigv4', 'sigv4');
    // connection attempts (1-3). For a custom origin it also sets how many times CloudFront tries to get a response after an origin response timeout. Default 3.
    const ATTEMPTS = 1;
    const ORIGIN_CONFIG = { httpPort: 80, httpsPort: 443, originProtocolPolicy: 'https-only', originSslProtocols: ['TLSv1.2'], originReadTimeout: 3 };
    const globalOrigin = { id: 'global-origin', domainName: global.attrDomainName, originAccessControlId: oacV4a.attrId, customOriginConfig: ORIGIN_CONFIG, connectionAttempts: ATTEMPTS, connectionTimeout: 10 };
    const virginiaOrigin = { id: 'virginia-origin', domainName: virginiaDomain, originAccessControlId: oacV4.attrId, customOriginConfig: ORIGIN_CONFIG, connectionAttempts: ATTEMPTS, connectionTimeout: 10 };
    const common = { compress: false, cachePolicyId: CACHING_DISABLED, originRequestPolicyId: ALL_VIEWER_EXCEPT_HOST, viewerProtocolPolicy: 'redirect-to-https' };

    // Origin group (OPTIONS must be a cached method, otherwise CloudFront does not fail over)
    const distOriginGroup = new cloudfront.CfnDistribution(this, 'DistOriginGroup', {
      distributionConfig: {
        enabled: true, comment: `${this.stackName} Origin group (primary global, secondary Virginia)`,
        origins: [globalOrigin, virginiaOrigin],
        originGroups: { quantity: 1, items: [{
          id: 'og-global-virginia',
          failoverCriteria: { statusCodes: { quantity: 4, items: [500, 502, 503, 504] } },
          members: { quantity: 2, items: [{ originId: 'global-origin' }, { originId: 'virginia-origin' }] },
        }] },
        defaultCacheBehavior: {
          ...common, targetOriginId: 'og-global-virginia',
          allowedMethods: ['GET', 'HEAD', 'OPTIONS'], cachedMethods: ['GET', 'HEAD', 'OPTIONS'],
        },
      },
    });
    // Global only (no origin group)
    const distGlobalOnly = new cloudfront.CfnDistribution(this, 'DistGlobalOnly', {
      distributionConfig: {
        enabled: true, comment: `${this.stackName} Global only`,
        origins: [globalOrigin],
        defaultCacheBehavior: { ...common, targetOriginId: 'global-origin', allowedMethods: ['GET', 'HEAD'] },
      },
    });
    new lambda.CfnResourcePolicy(this, 'Policy', {
      resourceArn: fn.attrFunctionArn,
      policyDocument: {
        Version: '2012-10-17',
        Statement: [{
          Sid: 'AllowCloudFront', Effect: 'Allow', Principal: { Service: 'cloudfront.amazonaws.com' },
          Action: 'lambda:InvokeWebFunctionEndpoint',
          Resource: [global.attrEndpointArn, regional.attrEndpointArn],
          Condition: { StringEquals: { 'aws:SourceArn': [
            `arn:${this.partition}:cloudfront::${this.account}:distribution/${distOriginGroup.ref}`,
            `arn:${this.partition}:cloudfront::${this.account}:distribution/${distGlobalOnly.ref}`,
          ] } },
        }],
      },
    });
    new cdk.CfnOutput(this, 'DomainOriginGroup', { value: distOriginGroup.attrDomainName });
    new cdk.CfnOutput(this, 'IdOriginGroup', { value: distOriginGroup.ref });
    new cdk.CfnOutput(this, 'DomainGlobalOnly', { value: distGlobalOnly.attrDomainName });
    new cdk.CfnOutput(this, 'IdGlobalOnly', { value: distGlobalOnly.ref });
    new cdk.CfnOutput(this, 'GlobalDomain', { value: global.attrDomainName });
    new cdk.CfnOutput(this, 'VirginiaDomain', { value: virginiaDomain });
  }
}

import http from 'node:http';

// Failure-injection app. FAIL_REGION / FAIL_FROM_MS / FAIL_UNTIL_MS / FAIL_MODE / DELAY_MS are replaced at build time (esbuild --define).
// In FAIL_REGION and between FAIL_FROM_MS and FAIL_UNTIL_MS (epoch ms):
//   FAIL_MODE "503"   : answer 503 immediately
//   FAIL_MODE "delay" : wait DELAY_MS, then answer 200 (so a client that does not give up sees a slow success)
// otherwise answer 200 immediately.
declare const FAIL_REGION: string;
declare const FAIL_FROM_MS: number;
declare const FAIL_UNTIL_MS: number;
declare const FAIL_MODE: string;
declare const DELAY_MS: number;
const port = Number(process.env.LOCAL_PORT ?? 3000);

http.createServer((req, res) => {
  const region = process.env.AWS_REGION ?? '';
  const now = Date.now();
  const failing = region === FAIL_REGION && now >= FAIL_FROM_MS && now < FAIL_UNTIL_MS;
  const body = { region, failing, requestId: String(req.headers['lambda-web-request-id'] ?? '') };
  console.log(JSON.stringify({ ...body, mode: failing ? FAIL_MODE : 'normal', path: req.url, host: req.headers.host, userAgent: req.headers['user-agent'] }));
  const respond = (status: number) => {
    res.statusCode = status;
    res.setHeader('content-type', 'application/json');
    res.end(JSON.stringify(body));
  };
  if (failing && FAIL_MODE === 'delay') setTimeout(() => respond(200), DELAY_MS);
  else respond(failing ? 503 : 200);
}).listen(port, () => console.log(`listening on port ${port}`));

#!/bin/bash
# usage: build-fail.sh <fail-region> <fail-from-epoch-ms> <fail-until-epoch-ms> [mode: 503|delay (default 503)] [delay-ms (default 0)]
# -> app-fail/index.js (CJS), built in Docker
set -euo pipefail
cd "$(dirname "$0")"
docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp -v "$PWD:/app" -w /app node:22 \
  npx esbuild app-src/fail.ts --bundle --platform=node --target=node22 --format=cjs --outfile=app-fail/index.js \
  --define:FAIL_REGION="\"$1\"" --define:FAIL_FROM_MS="$2" --define:FAIL_UNTIL_MS="$3" \
  --define:FAIL_MODE="\"${4:-503}\"" --define:DELAY_MS="${5:-0}"