feat(cloudfront): `function URL` origin access control L2 construct #31339

watany-dev · 2024-09-06T09:45:27Z

Issue # (if applicable)

Reason for this change

This change introduces support for Lambda Function URLs with custom Origin Access Control (OAC) in CloudFront distributions, enhancing security and control over CloudFront-Lambda integration.

Description of changes

Added a new feature allowing the configuration of Lambda Function URLs with custom OAC in CloudFront.
Implemented support for custom signing behavior and protocols for Lambda origins.
Included new tests to validate the correct behavior of OAC with Lambda Function URLs.

Description of how you validated changes

Ran unit tests to ensure that the OAC setup for Lambda Function URLs is correctly applied in CloudFront distributions.
Validated by deploying a sample CDK application to confirm the functionality and integration of Lambda Function URLs with CloudFront using OAC.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES
OAC implementation is complete.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

…b.com/watany-dev/aws-cdk into lambda-url-oac

gracelu0

Thanks for working on this so quickly @watany-dev! :)

gracelu0 · 2024-09-10T01:54:11Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

+ * An Origin for a Lambda Function URL with OAC.
+ */
+export class FunctionUrlOriginWithOAC extends cloudfront.OriginBase {


Let's keep this class private as it's an implementation detail and not intended for public usage

fixed.
a43bf40

packages/aws-cdk-lib/aws-cloudfront/test/origin-access-control.test.ts

gracelu0 · 2024-09-10T02:21:06Z

packages/aws-cdk-lib/aws-cloudfront-origins/test/function-url-origin.test.ts

+  new cloudfront.Distribution(stack, 'MyDistribution', {
+    defaultBehavior: {
+      origin: FunctionUrlOrigin.withOriginAccessControl(fnUrl, {
+        originAccessControl: undefined,


why is undefined passed here? Could we just leave out the props altogether?

fixed.
f660a83

gracelu0 · 2024-09-10T02:39:43Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

+    }
+
+    new lambda.CfnPermission(scope, `InvokeFromApiFor${options.originId}`, {


Can we move this into a private function? It would make it clearer and easier to understand why a new permission is getting created

Also is it possible to use any existing grant or addPermission methods here instead? And how do we handle permissions for imported lambda functions?

It seems like there might still be a potential bug with addPermission, so I’m using cfnPermission instead. It’s not too complex, and since the cross-stack test is passing, I don't have any concerns. Here’s a reference (apologies, it's in Japanese!) https://dev.classmethod.jp/articles/cdk-over-21-lambda-create-error/.

fixed.
2ad9170
989141b

...dk-testing/framework-integ/test/aws-cloudfront-origins/test/integ.function-url-origin-oac.ts

gracelu0 · 2024-09-10T02:50:34Z

packages/aws-cdk-lib/aws-cloudfront-origins/test/function-url-origin.test.ts

+
+  const template = Template.fromStack(stack);
+
+  template.hasResourceProperties('AWS::CloudFront::Distribution', {


since this test is checking for the correct permissions, can we also check the AWS::Lambda::Permission resource exists in the template and has the expected policy?

fixed.
7226680

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

rhermes62 · 2024-10-21T17:57:59Z

Just to confirm, will this proposal work well with Lambda function aliases and versions?

Background: Lambda provisioned concurrency only works with Lambda function versions or aliases. Given that, we have all of our function URLs pointing to aliases instead of "normal" Lambda functions. Before this was merged, just wanted to make sure this PR would also accommodate function URLs backed by versions/aliases.

From updated README looks like the answer is yes and it would be something like:

const alias = fn.addAlias('Live', { provisionedConcurrentExecutions });

const aliasUrl = alias.addFunctionUrl({
  authType: lambda.FunctionUrlAuthType.AWS_IAM,
});

new cloudfront.Distribution(this, 'MyDistribution', {
  defaultBehavior: {
    origin: origins.FunctionUrlOrigin.withOriginAccessControl(aliasUrl),
  },
});

Might be worth adding to README updates given this may be a pretty common pattern.

gracelu0 · 2024-10-22T00:23:17Z

...ing/framework-integ/test/aws-cloudfront-origins/test/integ.function-url-origin-oac-custom.ts

+  body: 'Forbidden',
+}));
+
+app.synth();


nit: we no longer need app.synth() in integ tests so this line can be removed from the new integ tests

fixed.
baddb09

gracelu0 · 2024-10-22T17:32:12Z

Just to confirm, will this proposal work well with Lambda function aliases and versions?

Background: Lambda provisioned concurrency only works with Lambda function versions or aliases. Given that, we have all of our function URLs pointing to aliases instead of "normal" Lambda functions. Before this was merged, just wanted to make sure this PR would also accommodate function URLs backed by versions/aliases.

From updated README looks like the answer is yes and it would be something like:
const alias = fn.addAlias('Live', { provisionedConcurrentExecutions });

const aliasUrl = alias.addFunctionUrl({
  authType: lambda.FunctionUrlAuthType.AWS_IAM,
});

new cloudfront.Distribution(this, 'MyDistribution', {
  defaultBehavior: {
    origin: origins.FunctionUrlOrigin.withOriginAccessControl(aliasUrl),
  },
});
Might be worth adding to README updates given this may be a pretty common pattern.

Thanks for pointing out this use case! I tested setting up a Lambda function alias with OAC with this API and it deployed/setup successfully. @watany-dev could you please add an integration test and README example for this use case?

watany-dev · 2024-10-24T12:32:46Z

@rhermes62 @gracelu0
Thank you. I am happy to share that I was also able to confirm the Alias pattern.
8be1369

gracelu0 · 2024-10-29T17:53:12Z

Thank you @watany-dev ! We are still pending the security review and service team confirmation, we appreciate your effort and patience in getting this reviewed.

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

Pull request has been modified.

watany-dev · 2024-11-18T02:47:17Z

@gracelu0
Could you please provide an update on the status of this review?

gracelu0 · 2024-11-18T23:05:50Z

Hi @watany-dev , I think it looks good! Just waiting on confirmation from security reviewer before I approve (should be very soon!).

gracelu0

Thank you so much for working on this @watany-dev !

mergify · 2024-11-18T23:54:16Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

codecov · 2024-11-19T00:05:50Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 77.18%. Comparing base (771eeff) to head (d838678).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #31339   +/-   ##
=======================================
  Coverage   77.18%   77.18%           
=======================================
  Files         105      105           
  Lines        7161     7161           
  Branches     1312     1312           
=======================================
  Hits         5527     5527           
  Misses       1454     1454           
  Partials      180      180

Flag	Coverage Δ
suite.unit	`77.18% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`77.18% <ø> (ø)`

---- 🚨 Try these New Features:

Flaky Tests Detection - Detect and resolve failed and flaky tests
JS Bundle Analysis - Avoid shipping oversized bundles

aws-cdk-automation · 2024-11-19T00:28:21Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: d838678
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-11-19T00:28:44Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2024-11-19T00:29:05Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

watany-dev added 2 commits September 6, 2024 07:07

oac

bc5f929

wip: oac fin

80f07f7

github-actions bot added p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Sep 6, 2024

aws-cdk-automation requested a review from a team September 6, 2024 09:45

aws-cdk-automation previously requested changes Sep 6, 2024

View reviewed changes

watany-dev added 4 commits September 6, 2024 16:16

oai

a6386c1

fix oai

da605ea

remove oai

b2baafa

snapshoted

5a7352a

watany-dev changed the title ~~WIP: feat(cloudfront): Function URL origin access control L2 construct~~ feat(cloudfront): Function URL origin access control L2 construct Sep 7, 2024

Merge branch 'main' into lambda-url-oac

8e8e2ac

watany-dev changed the title ~~feat(cloudfront): Function URL origin access control L2 construct~~ feat(cloudfront): function URL origin access control L2 construct Sep 7, 2024

watany-dev added 3 commits September 7, 2024 08:38

fix doctest

7fcbea3

Merge branches 'lambda-url-oac' and 'lambda-url-oac' of https://githu…

12f13f9

…b.com/watany-dev/aws-cdk into lambda-url-oac

snapshotted

b257227

watany-dev mentioned this pull request Sep 7, 2024

Support AWS SigV4 signatures for Lambdalith's running Hono with IAM Authorization - RPC Client-side honojs/hono#3382

Open

watany-dev added 3 commits September 7, 2024 14:06

fix doctest

8f24a4a

fixed

81c0785

refactor

47775c8

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Sep 8, 2024

Merge branch 'main' into lambda-url-oac

df0c972

moelasmar requested a review from gracelu0 September 8, 2024 06:55

github-actions bot mentioned this pull request Sep 9, 2024

Weekly PR metrics report #31370

Closed

gracelu0 previously requested changes Sep 10, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Sep 10, 2024

watany-dev added 3 commits September 10, 2024 16:58

hide private class

a43bf40

nest the new tests under a new describe

3731370

just leave out the props altogether

f660a83

gracelu0 reviewed Oct 16, 2024

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts Outdated Show resolved Hide resolved

gracelu0 reviewed Oct 22, 2024

View reviewed changes

watany-dev added 3 commits October 24, 2024 07:05

rename method name

f958621

remove app.synth

baddb09

integ alias

8be1369

watany-dev requested a review from gracelu0 October 24, 2024 12:31

gracelu0 previously requested changes Nov 5, 2024

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts Outdated Show resolved Hide resolved

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 5, 2024

watany-dev added 2 commits November 5, 2024 16:12

Warning to Error

1b41408

Error If AuthType is None

86f60d8

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 7, 2024

remove unuse import

ada7bee

watany-dev requested a review from gracelu0 November 18, 2024 02:47

gracelu0 approved these changes Nov 18, 2024

View reviewed changes

Merge branch 'main' into lambda-url-oac

d838678

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 18, 2024

mergify bot merged commit b8f47c8 into aws:main Nov 19, 2024
20 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Nov 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cloudfront): `function URL` origin access control L2 construct #31339

feat(cloudfront): `function URL` origin access control L2 construct #31339

watany-dev commented Sep 6, 2024 •

edited by gracelu0

Loading

aws-cdk-automation left a comment

gracelu0 left a comment

gracelu0 Sep 10, 2024

watany-dev Sep 10, 2024

gracelu0 Sep 10, 2024

watany-dev Sep 10, 2024

gracelu0 Sep 10, 2024

gracelu0 Sep 10, 2024

watany-dev Sep 10, 2024

watany-dev Sep 10, 2024 •

edited

Loading

gracelu0 Sep 10, 2024

watany-dev Sep 10, 2024

rhermes62 commented Oct 21, 2024

gracelu0 Oct 22, 2024

watany-dev Oct 24, 2024

gracelu0 commented Oct 22, 2024

watany-dev commented Oct 24, 2024

gracelu0 commented Oct 29, 2024

watany-dev commented Nov 18, 2024

gracelu0 commented Nov 18, 2024

gracelu0 left a comment

mergify bot commented Nov 18, 2024

codecov bot commented Nov 19, 2024 •

edited

Loading

aws-cdk-automation commented Nov 19, 2024

mergify bot commented Nov 19, 2024

github-actions bot commented Nov 19, 2024

		}

		new lambda.CfnPermission(scope, `InvokeFromApiFor${options.originId}`, {


		const template = Template.fromStack(stack);

		template.hasResourceProperties('AWS::CloudFront::Distribution', {

feat(cloudfront): function URL origin access control L2 construct #31339

feat(cloudfront): function URL origin access control L2 construct #31339

Conversation

watany-dev commented Sep 6, 2024 • edited by gracelu0 Loading

Reason for this change

Description of changes

Description of how you validated changes

Checklist

aws-cdk-automation left a comment

Choose a reason for hiding this comment

gracelu0 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

watany-dev Sep 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rhermes62 commented Oct 21, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gracelu0 commented Oct 22, 2024

watany-dev commented Oct 24, 2024

gracelu0 commented Oct 29, 2024

watany-dev commented Nov 18, 2024

gracelu0 commented Nov 18, 2024

gracelu0 left a comment

Choose a reason for hiding this comment

mergify bot commented Nov 18, 2024

codecov bot commented Nov 19, 2024 • edited Loading

Codecov Report

aws-cdk-automation commented Nov 19, 2024

AWS CodeBuild CI Report

mergify bot commented Nov 19, 2024

github-actions bot commented Nov 19, 2024

feat(cloudfront): `function URL` origin access control L2 construct #31339

feat(cloudfront): `function URL` origin access control L2 construct #31339

watany-dev commented Sep 6, 2024 •

edited by gracelu0

Loading

watany-dev Sep 10, 2024 •

edited

Loading

codecov bot commented Nov 19, 2024 •

edited

Loading