Hands-On with the New Amazon CloudFront Support for AWS Lambda Web Functions

On October 12, 2026, Amazon Web Services introduced support for using AWS Lambda Web Functions as origins for Amazon CloudFront. This capability allows web applications running on Lambda Web Functions to be delivered through CloudFront's global edge network without requiring changes to application code.

By placing CloudFront in front of a Lambda Web Function, applications can benefit from caching, custom domains with managed TLS certificates, and additional security through AWS WAF. CloudFront Origin Access Control (OAC) can also restrict access to the Lambda Web Function so that requests reach the origin through CloudFront.

In this post, I explored the new integration by configuring a Lambda Web Function as a CloudFront origin and verifying the setup using HTTP requests.

Setup

To test the new feature, I created a Lambda Web Function in ap-southeast-1 using Node.js 24.x and the default Hello World template. For CloudFront OAC integration, the endpoint must use IAM authentication (IamAuth). I configured an endpoint named web-function-endpoint with the Home-Region endpoint type, IAM authentication enabled, and automatic deployment enabled.

The Home-Region endpoint is a regional endpoint for the Lambda Web Function. The endpoint type is selected during creation and cannot be changed afterward. With IamAuth enabled, requests to the endpoint must be authenticated before the endpoint can be invoked.

I then created a CloudFront distribution and configured the Lambda Web Function endpoint as its origin. Under Origin access, I enabled Allow private Lambda function access to CloudFront to use Origin Access Control (OAC).

To allow CloudFront to invoke the endpoint, I configured a resource-based policy on the Lambda Web Function. The policy grants the CloudFront service principal permission to invoke the endpoint and restricts access to the specific distribution using aws:SourceArn.

Example policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCloudFrontOACAccess",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudfront.amazonaws.com"
      },
      "Action": "lambda:InvokeWebFunctionEndpoint",
      "Resource": "arn:aws:lambda:ap-southeast-1:<ACCOUNT_ID>:web-function/lab-web-function/endpoint/web-function-endpoint",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cloudfront::<ACCOUNT_ID>:distribution/<DISTRIBUTION_ID>"
        }
      }
    }
  ]
}

I applied the policy using the AWS CLI:

aws lambda-web put-resource-policy \
  --resource-arn "arn:aws:lambda:ap-southeast-1:<ACCOUNT_ID>:web-function/lab-web-function" \
  --policy file://policy.json \
  --region ap-southeast-1

Replace <ACCOUNT_ID> and <DISTRIBUTION_ID> with your actual values. Note that the policy uses the endpoint ARN, while the CLI command uses the Lambda Web Function ARN.

According to AWS documentation, several configuration details are important when using a Lambda Web Function as a CloudFront origin with OAC:

• IAM authentication: The endpoint must use IamAuth so that requests are authenticated and authorized through the Lambda Web Function's resource-based policy.
• OAC signing protocol: sigv4 for regional endpoints (Home-Region and Per-Region) and sigv4a for global endpoints (Multi-Region).
• Signing behavior: Lambda Web Function origins support always-amz-auth (Always sign, preserve viewer authorization), which signs origin requests while preserving the viewer's original Authorization header.
• Origin request policy: If you use an origin request policy, it must exclude the viewer's Host header. If you use a managed policy, use AllViewerExceptHostHeader instead of AllViewer to avoid 404 responses caused by forwarding the viewer's Host header.
• Authorization header: If the application uses the viewer's Authorization header, include it in the cache policy for every cache behavior that uses the origin.
• Global endpoints: OAC does not support global endpoints that include opt-in Regions. All associated Regions must be enabled by default.
• Lambda@Edge: Origin request and origin response triggers are not supported on cache behaviors that use a Lambda Web Function origin with OAC.

Verification

To verify the configuration, I first sent a request directly to the Lambda Web Function endpoint using curl.

curl -i https://<LAMBDA_WEB_FUNCTION_ENDPOINT>

Output:

The 403 Forbidden response is consistent with the endpoint requiring IAM-signed requests. The direct request did not return the default application response.

I then sent a request through the CloudFront distribution.

curl -i https://<CLOUDFRONT_DOMAIN>

Output:

The successful 200 OK response confirms that the request through CloudFront received a successful response from the configured origin. The response also included X-Cache: Miss from cloudfront, consistent with the managed CachingDisabled policy used during testing.

Analysis

From testing, direct requests to the Lambda Web Function endpoint returned 403 Forbidden, while requests through CloudFront returned 200 OK. These results are consistent with OAC restricting the origin to requests from the configured CloudFront distribution through signed origin requests and the resource-based policy.

This integration allows serverless web applications running on Lambda Web Functions to use CloudFront's content delivery and security capabilities while restricting direct access to the origin through Origin Access Control (OAC).

Based on the capabilities AWS describes, this setup suits workloads such as:

• Serverless web applications that need custom domains and managed TLS certificates
• Web applications that benefit from CloudFront caching
• Applications that need additional application-layer protection through AWS WAF
• Applications that require controlled access to the origin through OAC

According to AWS, OAC restricts access to the Lambda Web Function so that it is reachable only through CloudFront. This allows CloudFront to serve as the entry point while keeping direct access to the origin restricted.

Conclusion

Based on this hands-on test, Amazon CloudFront support for AWS Lambda Web Functions allows CloudFront to serve as the entry point for serverless web applications while restricting direct access to the origin through Origin Access Control (OAC). The successful HTTP response through CloudFront and the rejected direct endpoint request match the expected behavior of the configured setup.

For applications built on Lambda Web Functions, this integration provides a way to use CloudFront's delivery and security capabilities without requiring changes to application code.

CloudFront support for AWS Lambda Web Functions is available worldwide except in the CloudFront China Regions, with no additional fees for the integration.