Lambda Web Functions を CloudFront OAC で保護すると、POST / PUT の x-amz-content-sha256 が不要になる

cf-lambda-web-functions/
├── app/src/index.ts           # Hono の検証用アプリ
├── bin/app.ts                 # ap-northeast-1 に 1 スタック
└── lib/web-function-stack.ts  # スタック本体

import { createHash } from 'node:crypto';
import { serve } from '@hono/node-server';
import { Hono } from 'hono';
import { streamSSE } from 'hono/streaming';

const app = new Hono();

app.get('/', (c) =>
  c.json({
    message: 'Hello from Lambda Web Functions',
    region: process.env.AWS_REGION ?? null,
    requestId: c.req.header('lambda-web-request-id') ?? null,
  }),
);

// CloudFront (OAC) 経由の POST で body がそのまま届くかを確認する。
// クライアントは x-amz-content-sha256 を付けずに送る想定
app.post('/echo', async (c) => {
  const body = Buffer.from(await c.req.arrayBuffer());
  return c.json({
    bytes: body.length,
    sha256: createHash('sha256').update(body).digest('hex'),
    contentType: c.req.header('content-type') ?? null,
  });
});

// viewer の Authorization ヘッダーが関数まで届くかを確認する
app.get('/headers', (c) => c.json(c.req.header()));

// レスポンスストリーミングを確認する
app.get('/stream', (c) =>
  streamSSE(c, async (stream) => {
    for (let i = 0; i < 5; i++) {
      await stream.writeSSE({ data: JSON.stringify({ i, time: new Date().toISOString() }) });
      await stream.sleep(1000);
    }
  }),
);

// Lambda が AWS_LAMBDA_HTTP_ENDPOINT (host:port) で待ち受け先を渡す。未設定はローカル実行時のみ
const [hostname, port] = (process.env.AWS_LAMBDA_HTTP_ENDPOINT ?? 'localhost:3000').split(':');
serve({ fetch: app.fetch, hostname, port: Number(port) }, (info) => {
  console.log(`listening on ${info.address}:${info.port}`);
});

const codeBucket = new s3.Bucket(this, 'CodeBucket', {
  versioned: true,
  blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
  enforceSSL: true,
  removalPolicy: cdk.RemovalPolicy.DESTROY,
  autoDeleteObjects: true,
});
codeBucket.addToResourcePolicy(
  new iam.PolicyStatement({
    principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
    actions: ['s3:GetObject', 's3:GetObjectVersion'],
    resources: [codeBucket.arnForObjects('*')],
    conditions: {
      ArnLike: {
        'aws:SourceArn': this.formatArn({
          service: 'lambda',
          resource: 'web-function',
          resourceName: `${functionName}/revision/*`,
        }),
      },
    },
  }),
);

const code = new s3deploy.BucketDeployment(this, 'CodeDeployment', {
  sources: [
    s3deploy.Source.asset(appDir, {
      assetHashType: cdk.AssetHashType.OUTPUT,
      bundling: {
        image: cdk.DockerImage.fromRegistry('public.ecr.aws/docker/library/node:24'),
        local: {
          tryBundle(outputDir) {
            buildSync({
              entryPoints: [path.join(appDir, 'src/index.ts')],
              outfile: path.join(outputDir, 'index.js'),
              bundle: true,
              platform: 'node',
              target: 'node24',
              format: 'cjs',
              minify: true,
            });
            return true;
          },
        },
      },
    }),
  ],
  destinationBucket: codeBucket,
  extract: false,
  prune: false,
});

const webFunction = new lambda.CfnWebFunction(this, 'WebFunction', {
  functionName,
});

const revision = new lambda.CfnWebFunctionRevision(this, 'Revision', {
  functionName: webFunction.attrFunctionArn,
  buildConfig: {
    codeConfig: {
      s3Object: {
        bucket: codeBucket.bucketName,
        key: cdk.Fn.select(0, code.objectKeys),
        versionId: cdk.Fn.select(0, code.objectVersionIds),
      },
    },
    runtimeConfig: { runtime: 'nodejs24.x' },
  },
  serviceConfig: {
    executionRoleArn: executionRole.roleArn,
    timeoutSeconds: 30,
  },
});
// revision 作成時に Lambda がバケットを読めるよう、バケットポリシーの反映を先に済ませる
revision.node.addDependency(codeBucket.policy!);

const endpoint = new lambda.CfnWebFunctionEndpoint(this, 'Endpoint', {
  functionName: webFunction.attrFunctionArn,
  endpointName: 'prod',
  endpointType: 'HomeRegion',
  // CloudFront OAC から署名付きで呼ばせ、直接アクセスは 403 にする
  authType: 'IamAuth',
  revisionWeights: [{ revisionId: revision.attrRevisionId, weight: 100 }],
});

const oac = new cloudfront.CfnOriginAccessControl(this, 'OriginAccessControl', {
  originAccessControlConfig: {
    name: `${this.stackName}-web-function`,
    originAccessControlOriginType: 'lambda',
    signingBehavior: 'always-amz-auth',
    signingProtocol: 'sigv4',
  },
});

const cachePolicy = new cloudfront.CachePolicy(this, 'CachePolicy', {
  minTtl: cdk.Duration.seconds(0),
  defaultTtl: cdk.Duration.seconds(0),
  maxTtl: cdk.Duration.seconds(1),
  headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Authorization'),
  queryStringBehavior: cloudfront.CacheQueryStringBehavior.all(),
  cookieBehavior: cloudfront.CacheCookieBehavior.all(),
});

const distribution = new cloudfront.Distribution(this, 'Distribution', {
  defaultBehavior: {
    origin: new origins.HttpOrigin(endpoint.attrDomainName, {
      protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
      originAccessControlId: oac.attrId,
    }),
    viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
    allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
    cachePolicy,
    originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
  },
});

new lambda.CfnResourcePolicy(this, 'ResourcePolicy', {
  resourceArn: webFunction.attrFunctionArn,
  policyDocument: new iam.PolicyDocument({
    statements: [
      new iam.PolicyStatement({
        principals: [new iam.ServicePrincipal('cloudfront.amazonaws.com')],
        actions: ['lambda:InvokeWebFunctionEndpoint'],
        resources: [endpoint.attrEndpointArn],
        conditions: {
          StringEquals: { 'aws:SourceArn': distribution.distributionArn },
        },
      }),
    ],
  }),
});

bun run deploy

[Warning] Template validation found issues in your templates (reported as warnings).
Set feature flag "@aws-cdk/core:validateAgainstDefaultRules" to true to turn these into errors.
lib/web-function-stack.ts:87:25
WARNING Unknown resource type 'AWS::Lambda::WebFunction' (CloudFormation Validate)
   CfLambdaWebFunctions/WebFunction (WebFunction) aws-cdk-lib.aws_lambda.CfnWebFunction
   Acknowledge with 'CloudFormation-Validate::F3006'
...
CfLambdaWebFunctions: deploying... [1/1]
CfLambdaWebFunctions |  2/20 | 11:00:04 AM | CREATE_COMPLETE         | AWS::CloudFront::OriginAccessControl | OriginAccessControl
CfLambdaWebFunctions |  3/20 | 11:00:04 AM | CREATE_COMPLETE         | AWS::CloudFront::CachePolicy         | CachePolicy (CachePolicy26D8A535)
CfLambdaWebFunctions |  4/20 | 11:00:08 AM | CREATE_COMPLETE         | AWS::Lambda::WebFunction             | WebFunction
...
CfLambdaWebFunctions | 15/20 | 11:00:57 AM | CREATE_COMPLETE         | Custom::CDKBucketDeployment          | CodeDeployment/CustomResource/Default (CodeDeploymentCustomResource443F2B7D)
CfLambdaWebFunctions | 15/20 | 11:01:08 AM | CREATE_IN_PROGRESS      | AWS::Lambda::WebFunctionRevision     | Revision
CfLambdaWebFunctions | 16/20 | 11:01:13 AM | CREATE_COMPLETE         | AWS::Lambda::WebFunctionRevision     | Revision
CfLambdaWebFunctions | 16/20 | 11:01:14 AM | CREATE_IN_PROGRESS      | AWS::Lambda::WebFunctionEndpoint     | Endpoint
CfLambdaWebFunctions | 17/20 | 11:01:19 AM | CREATE_COMPLETE         | AWS::Lambda::WebFunctionEndpoint     | Endpoint
CfLambdaWebFunctions | 17/20 | 11:01:20 AM | CREATE_IN_PROGRESS      | AWS::CloudFront::Distribution        | Distribution (Distribution830FAC52)
CfLambdaWebFunctions | 17/20 | 11:01:25 AM | CREATE_IN_PROGRESS      | AWS::Lambda::ResourcePolicy          | ResourcePolicy
CfLambdaWebFunctions | 18/20 | 11:01:27 AM | CREATE_COMPLETE         | AWS::Lambda::ResourcePolicy          | ResourcePolicy
CfLambdaWebFunctions | 19/20 | 11:04:27 AM | CREATE_COMPLETE         | AWS::CloudFront::Distribution        | Distribution (Distribution830FAC52)
CfLambdaWebFunctions | 20/20 | 11:04:30 AM | CREATE_COMPLETE         | AWS::CloudFormation::Stack           | CfLambdaWebFunctions

✅  CfLambdaWebFunctions

✨  Deployment time: 271.46s

Outputs:
CfLambdaWebFunctions.DistributionUrl = https://dxxxxxxxxxxxxx.cloudfront.net
CfLambdaWebFunctions.EndpointUrl = https://xxxxxxxxxxxxxxxx.xxx.lambda-web.ap-northeast-1.on.aws

DISTRIBUTION_URL=https://dxxxxxxxxxxxxx.cloudfront.net
ENDPOINT_URL=https://xxxxxxxxxxxxxxxx.xxx.lambda-web.ap-northeast-1.on.aws

head -c 2000000 /dev/urandom > /tmp/body.bin
shasum -a 256 /tmp/body.bin
curl -s -X POST --data-binary @/tmp/body.bin -H 'content-type: application/octet-stream' $DISTRIBUTION_URL/echo

1e97822a9d671d74e5b0a0190e20e2ce4b4e7ab0811fb76b955695a55d7b8a6f  /tmp/body.bin
{"bytes":2000000,"sha256":"1e97822a9d671d74e5b0a0190e20e2ce4b4e7ab0811fb76b955695a55d7b8a6f","contentType":"application/octet-stream"}

curl -s -H 'Authorization: Bearer test' $DISTRIBUTION_URL/headers

{"accept":"*/*","authorization":"Bearer test","cloudfront-forwarded-proto":"https","cloudfront-is-android-viewer":"false","cloudfront-is-desktop-viewer":"true","cloudfront-is-ios-viewer":"false","cloudfront-is-mobile-viewer":"false","cloudfront-is-smarttv-viewer":"false","cloudfront-is-tablet-viewer":"false","cloudfront-viewer-address":"104.28.174.0:36845","cloudfront-viewer-asn":"13335","cloudfront-viewer-city":"Saitama","cloudfront-viewer-country":"JP","cloudfront-viewer-country-name":"Japan","cloudfront-viewer-country-region":"11","cloudfront-viewer-country-region-name":"Saitama","cloudfront-viewer-http-version":"2.0","cloudfront-viewer-latitude":"35.91040","cloudfront-viewer-longitude":"139.66060","cloudfront-viewer-postal-code":"330-0800","cloudfront-viewer-time-zone":"Asia/Tokyo","cloudfront-viewer-tls":"TLSv1.3:TLS_AES_128_GCM_SHA256:fullHandshake","connection":"close","host":"xxxxxxxxxxxxxxxx.xxx.lambda-web.ap-northeast-1.on.aws","lambda-web-endpoint-name":"prod","lambda-web-request-id":"PKW5RT3PAZYSCRUKNEYZSTLQIM","te":"trailers","user-agent":"curl/8.7.1","via":"2.0 9c8b15421bca36e4a3e74f62bbfbe1f8.cloudfront.net (CloudFront)","x-amz-cf-id":"TXoEgWLi1h8n5WLzfv4y7CHVXdTNs3gy22FDjWLL9XqEOjTSlKW0Jw==","x-forwarded-for":"104.28.174.0, 3.172.52.229","x-forwarded-port":"443","x-forwarded-proto":"https"}

curl -sN $DISTRIBUTION_URL/stream

data: {"i":0,"time":"2026-10-13T02:26:56.729Z"}

data: {"i":1,"time":"2026-10-13T02:26:57.730Z"}

data: {"i":2,"time":"2026-10-13T02:26:58.729Z"}

data: {"i":3,"time":"2026-10-13T02:26:59.731Z"}

data: {"i":4,"time":"2026-10-13T02:27:00.732Z"}

curl -i $ENDPOINT_URL/

HTTP/1.1 403 Forbidden
content-type: text/html
connection: keep-alive
lambda-web-request-id: ERJTBYIYD2ZI33UPPXCYBK2XR4
content-length: 230
date: Tue, 13 Oct 2026 02:27:03 GMT

<!DOCTYPE html>
<html>
<head>
    <title>HTTP Error 403</title>
</head>
<body>
    <h1>403 Forbidden</h1>
    <p>You are not authorized to access this endpoint.</p>
    <p>Request ID: ERJTBYIYD2ZI33UPPXCYBK2XR4</p>
</body>
</html>