I Tried Out Whether a Multi-Region Endpoint for Lambda Web Functions Reaches the Region with the Lowest Latency

npm install
./build-app.sh

# ヘルスチェック用（グローバル URL / リージョン別 URL）
npx cdkd deploy WebFnHcGlobal --yes
npx cdkd deploy WebFnHcRegional --yes
# CloudShell の curl・dig 用
npx cdkd deploy WebFnCurl --yes

# 測定後に撤去する（ヘルスチェックは残すと課金が続く）
npx cdkd destroy --all --force

{
  "name": "web-fn-global-hc",
  "version": "0.0.1",
  "private": true,
  "type": "commonjs",
  "dependencies": {
    "@go-to-k/cdkd": "0.299.3",
    "aws-cdk": "2.1145.0",
    "aws-cdk-lib": "2.273.0",
    "constructs": "10.5.0",
    "esbuild": "0.25.0",
    "typescript": "5.6.3",
    "ts-node": "10.9.2",
    "@types/node": "22.9.0"
  }
}

{ "app": "npx ts-node --prefer-ts-exts bin/app.ts", "context": { "@aws-cdk/core:newStyleStackSynthesis": true } }

{ "compilerOptions": { "target": "ES2022", "module": "commonjs", "strict": true, "esModuleInterop": true, "skipLibCheck": true, "outDir": "cdk.out-ts" }, "include": ["bin", "lib"] }

import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as r53 from 'aws-cdk-lib/aws-route53';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
import { Construct } from 'constructs';

// Regions to replicate the function to
const FN_REGIONS = ['ap-northeast-1', 'us-east-1', 'us-east-2', 'us-west-2', 'eu-west-1'];
// Regions of the Route 53 health checkers
const CHECKER_REGIONS = ['us-east-1', 'us-west-1', 'us-west-2', 'eu-west-1', 'ap-southeast-1', 'ap-southeast-2', 'ap-northeast-1', 'sa-east-1'];

abstract class BaseStack extends cdk.Stack {
  protected makeFunction(functionName: string, endpointType: 'MultiRegion' | 'PerRegion') {
    const { fn, revision } = this.makeFunctionBase(functionName);
    return this.makeEndpoint('Endpoint', 'main', endpointType, fn, revision);
  }

  protected makeEndpoint(id: string, endpointName: string, endpointType: 'MultiRegion' | 'PerRegion', fn: lambda.CfnWebFunction, revision: lambda.CfnWebFunctionRevision) {
    return new lambda.CfnWebFunctionEndpoint(this, id, {
      functionName: fn.ref,
      endpointName,
      endpointType,
      regions: FN_REGIONS, // the home Region is added automatically; listing it is allowed
      authType: 'ApplicationManaged', // no auth: the URLs are public. Delete the stacks after the test
      revisionWeights: [{ revisionId: revision.attrRevisionId, weight: 100 }],
    });
  }

  protected makeFunctionBase(functionName: string) {
    // Code bucket: versioning + bucket policy for lambda.amazonaws.com (Web Functions requirement)
    const codeBucket = new s3.Bucket(this, 'CodeBucket', {
      versioned: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
    });
    codeBucket.addToResourcePolicy(new iam.PolicyStatement({
      principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
      actions: ['s3:GetObject', 's3:GetObjectVersion'],
      resources: [codeBucket.arnForObjects('*')],
      conditions: { ArnLike: { 'aws:SourceArn': `arn:${this.partition}:lambda:${this.region}:${this.account}:web-function/*` } },
    }));
    const execRole = new iam.Role(this, 'ExecRole', {
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')],
    });
    const deployment = new s3deploy.BucketDeployment(this, 'Code', {
      sources: [s3deploy.Source.asset('app-ip')],
      destinationBucket: codeBucket,
      extract: false,
      prune: false,
    });
    const fn = new lambda.CfnWebFunction(this, 'Fn', { functionName });
    const revision = new lambda.CfnWebFunctionRevision(this, 'Revision', {
      functionName: fn.ref,
      buildConfig: {
        codeConfig: {
          s3Object: {
            bucket: codeBucket.bucketName,
            key: cdk.Fn.select(0, deployment.objectKeys),
            versionId: cdk.Fn.select(0, deployment.objectVersionIds),
          },
        },
        runtimeConfig: { runtime: 'nodejs24.x' },
      },
      serviceConfig: { executionRoleArn: execRole.roleArn, timeoutSeconds: 30 },
    });
    revision.node.addDependency(codeBucket.policy!);
    return { fn, revision };
  }

  protected makeHealthCheck(id: string, domainName: string) {
    return new r53.CfnHealthCheck(this, id, {
      healthCheckConfig: {
        type: 'HTTPS',
        fullyQualifiedDomainName: domainName,
        port: 443,
        resourcePath: '/ip/',
        requestInterval: 30,
        failureThreshold: 3,
        measureLatency: true,
        enableSni: true,
        regions: CHECKER_REGIONS,
      },
      healthCheckTags: [{ key: 'Name', value: `${this.stackName}-${id}` }],
    });
  }
}

// Global URL: one MultiRegion endpoint and one health check against it
export class GlobalStack extends BaseStack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);
    const endpoint = this.makeFunction('webfn-hc-global', 'MultiRegion');
    const hc = this.makeHealthCheck('HcGlobal', endpoint.attrDomainName);
    new cdk.CfnOutput(this, 'GlobalDomain', { value: endpoint.attrDomainName });
    new cdk.CfnOutput(this, 'HealthCheckId', { value: hc.attrHealthCheckId });
  }
}

// Per-Region URLs: one PerRegion endpoint and one health check per Region URL
export class RegionalStack extends BaseStack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);
    const endpoint = this.makeFunction('webfn-hc-regional', 'PerRegion');
    for (const r of FN_REGIONS) {
      const domain = cdk.Fn.getAtt(endpoint.logicalId, `RegionalEndpoints.${r}.DomainName`).toString();
      const hc = this.makeHealthCheck(`Hc${r.replace(/-/g, '')}`, domain);
      new cdk.CfnOutput(this, `Domain${r.replace(/-/g, '')}`, { value: domain });
      new cdk.CfnOutput(this, `HealthCheckId${r.replace(/-/g, '')}`, { value: hc.attrHealthCheckId });
    }
  }
}

// CloudShell: measure with curl/dig. No health checks.
// ONE function with BOTH a MultiRegion endpoint (global URL) and a PerRegion endpoint (per-Region URLs).
export class CurlStack extends BaseStack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);
    const { fn, revision } = this.makeFunctionBase('webfn-curl');
    const global = this.makeEndpoint('EndpointGlobal', 'global', 'MultiRegion', fn, revision);
    const regional = this.makeEndpoint('EndpointRegional', 'regional', 'PerRegion', fn, revision);
    regional.addDependency(global); // create one after the other
    new cdk.CfnOutput(this, 'GlobalDomain', { value: global.attrDomainName });
    for (const r of FN_REGIONS) {
      new cdk.CfnOutput(this, `Domain${r.replace(/-/g, '')}`, {
        value: cdk.Fn.getAtt(regional.logicalId, `RegionalEndpoints.${r}.DomainName`).toString(),
      });
    }
  }
}

import * as cdk from 'aws-cdk-lib';
import { CurlStack, GlobalStack, RegionalStack } from '../lib/hc-stacks';

const app = new cdk.App();
const env = { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'ap-northeast-1' };
// MultiRegion endpoint (one global URL) + 1 health check
new GlobalStack(app, 'WebFnHcGlobal', { env });
// PerRegion endpoints (one URL per Region) + 5 health checks
new RegionalStack(app, 'WebFnHcRegional', { env });
// One function, MultiRegion + PerRegion endpoints, for curl/dig from CloudShell (no health checks)
new CurlStack(app, 'WebFnCurl', { env });

import http from 'node:http';

// Web Function: returns the caller's IP (last value of X-Forwarded-For) and the Region that served the request.
// The same content is written to the log as one JSON line. Port 3000 is where Lambda sends requests.
const port = Number(process.env.LOCAL_PORT ?? 3000);

http.createServer((req, res) => {
  const xff = String(req.headers['x-forwarded-for'] ?? '');
  const ip = xff.split(',').map((s) => s.trim()).filter(Boolean).pop() ?? '';
  const body = {
    ip,
    region: process.env.AWS_REGION ?? '',
    requestId: String(req.headers['lambda-web-request-id'] ?? ''),
  };
  console.log(JSON.stringify({
    ...body,
    path: req.url,
    host: req.headers.host,
    userAgent: req.headers['user-agent'],
    xForwardedFor: xff,
  }));
  res.setHeader('content-type', 'application/json');
  res.end(JSON.stringify(body));
}).listen(port, () => console.log(`listening on port ${port}`));

#!/bin/bash
# Bundle app-src/ip.ts into app-ip/index.js (CJS) inside Docker.
set -euo pipefail
cd "$(dirname "$0")"
docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp -v "$PWD:/app" -w /app node:22 \
  npx esbuild app-src/ip.ts --bundle --platform=node --target=node22 --format=cjs --outfile=app-ip/index.js