Skip to content

Commit cc9a597

Browse files
brettstackbrettstack
committed
docs(examples/lambda-function-url): comment out OAC with notes
1 parent 4d36259 commit cc9a597

File tree

4 files changed

+47
-32
lines changed

4 files changed

+47
-32
lines changed

‎examples/lambda-function-url/packages/api/.env.development‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# WARNING: This file is committed to source control. Store secrets in .env.development.local instead of here.
22
NODE_ENV=development
3-
TODO_LIST_TABLE="Todo-development-TodoListTableC18CC639-SNMMJOK8224I"
4-
TODO_ITEM_TABLE="Todo-development-TodoItemTable4E6EC07F-F61W4KN831OH"
5-
USER_TABLE="Todo-development-UserTableD3CD785F-1CWH8SF13WCOS"
6-
COGNITO_USER_POOL_ID="us-west-2_MIQhmcA5v"
7-
COGNITO_USER_POOL_CLIENT_ID="7covdgpck9g0qlj93fm93n0pnj"
3+
TODO_LIST_TABLE="Todo-development-TodoListTableC18CC639-16GBSXSZ8FUJG"
4+
TODO_ITEM_TABLE="Todo-development-TodoItemTable4E6EC07F-133FJL20I2IFM"
5+
USER_TABLE="Todo-development-UserTableD3CD785F-XOWGEFCKBOZ3"
6+
COGNITO_USER_POOL_ID="us-west-2_5SWtxqJvA"
7+
COGNITO_USER_POOL_CLIENT_ID="7hdsj1dcn6esir5gua9r7tihf"

‎examples/lambda-function-url/packages/cdk/cdk-outputs.development.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
"Todo-development": {
3-
"TodoListTable": "Todo-development-TodoListTableC18CC639-SNMMJOK8224I",
4-
"UserPoolClientId": "7covdgpck9g0qlj93fm93n0pnj",
5-
"UserPoolId": "us-west-2_MIQhmcA5v",
6-
"TodoItemTable": "Todo-development-TodoItemTable4E6EC07F-F61W4KN831OH",
7-
"ExpressApiFunctionUrl": "https://d4nnw44cddanflk7kv3r3xbbke0uvnis.lambda-url.us-west-2.on.aws/",
8-
"CloudFrontDistributionUrl": "https://dthdcw7dsiu7v.cloudfront.net",
9-
"UserTable": "Todo-development-UserTableD3CD785F-1CWH8SF13WCOS",
3+
"TodoListTable": "Todo-development-TodoListTableC18CC639-16GBSXSZ8FUJG",
4+
"UserPoolClientId": "7hdsj1dcn6esir5gua9r7tihf",
5+
"UserPoolId": "us-west-2_5SWtxqJvA",
6+
"TodoItemTable": "Todo-development-TodoItemTable4E6EC07F-133FJL20I2IFM",
7+
"ExpressApiFunctionUrl": "https://2sczp4fme2sm3v7m2yo5mtcoky0vtvbl.lambda-url.us-west-2.on.aws/",
8+
"CloudFrontDistributionUrl": "https://d3azwsvxpl4x8e.cloudfront.net",
9+
"UserTable": "Todo-development-UserTableD3CD785F-XOWGEFCKBOZ3",
1010
"Region": "us-west-2",
11-
"ApiEndpoint": "https://0c8qrs3t4l.execute-api.us-west-2.amazonaws.com",
12-
"AmplifyUrl": "https://development.d12ag1linf6gxb.amplifyapp.com"
11+
"ApiEndpoint": "https://obuoc4bs0c.execute-api.us-west-2.amazonaws.com",
12+
"AmplifyUrl": "https://development.d1afcsnpzo7fev.amplifyapp.com"
1313
}
1414
}

‎examples/lambda-function-url/packages/cdk/lib/constructs/ExpressApi.ts‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -67,18 +67,33 @@ export default class ExpressApi extends Construct {
6767
}),
6868
},
6969
})
70-
const cloudFrontOriginAccessControl = new CfnOriginAccessControl(this, 'CloudFrontOriginAccessControl', {
71-
originAccessControlConfig: {
72-
name: `ExpressApi_${this.node.addr}`,
73-
originAccessControlOriginType: 'lambda',
74-
signingBehavior: 'no-override', // 'always' | 'never'
75-
signingProtocol: 'sigv4',
76-
},
77-
})
7870

79-
// NOTE: CDK doesn't natively support adding OAC yet https://github.com/aws/aws-cdk/issues/21771
80-
const cfnDistribution = cloudFrontDistribution.node.defaultChild as CfnDistribution
81-
cfnDistribution.addPropertyOverride('DistributionConfig.Origins.0.OriginAccessControlId', cloudFrontOriginAccessControl.getAtt('Id'))
71+
// NOTE: OAC currently isn't viable for APIs for two reasons:
72+
// 1. It doesn't sign PUT/POST payloads
73+
// 2. It overrides the Authorization header. You *may* be able to get around this with a CloudFront or Lambda@Edge Viewer Request Function that maps the
74+
// Authorization header to something else (e.g. x-client-authorization) and update the Express app to check that header instead (untested whether the original
75+
// Authorization header is available at that point). Alternatively, you could simply use a different on the client, but this is moving the problem to the client.
76+
// If you want to try OAC anyway, uncomment the below lines and change the Lambda Function URL authType from FunctionUrlAuthType.NONE to FunctionUrlAuthType.AWS_IAM
77+
// const cloudFrontDistributionArn = `arn:aws:cloudfront::${Stack.of(this).account}:distribution/${cloudFrontDistribution.distributionId}`
78+
79+
// this.lambdaFunction.addPermission('AllowCloudFrontPrincipalInvoke', {
80+
// principal: new ServicePrincipal('cloudfront.amazonaws.com'),
81+
// action: 'lambda:InvokeFunctionUrl',
82+
// sourceArn: cloudFrontDistributionArn,
83+
// })
84+
85+
// const cloudFrontOriginAccessControl = new CfnOriginAccessControl(this, 'CloudFrontOriginAccessControl', {
86+
// originAccessControlConfig: {
87+
// name: `ExpressApi_${this.node.addr}`,
88+
// originAccessControlOriginType: 'lambda',
89+
// signingBehavior: 'always', // 'always' | 'never'
90+
// signingProtocol: 'sigv4',
91+
// },
92+
// })
93+
94+
// // NOTE: CDK doesn't natively support adding OAC yet https://github.com/aws/aws-cdk/issues/21771
95+
// const cfnDistribution = cloudFrontDistribution.node.defaultChild as CfnDistribution
96+
// cfnDistribution.addPropertyOverride('DistributionConfig.Origins.0.OriginAccessControlId', cloudFrontOriginAccessControl.getAtt('Id'))
8297

8398
new CfnOutput(this, 'CloudFrontDistributionUrl', {
8499
key: 'CloudFrontDistributionUrl',

‎examples/lambda-function-url/packages/ui/.env/.env.development‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# WARNING: This file is committed to source control. Store secrets in .env.development.local instead of here.
22
NEXT_PUBLIC_AUTO_VERIFY_USERS=1
3-
NEXT_PUBLIC_ApiGatewayUrl="https://0c8qrs3t4l.execute-api.us-west-2.amazonaws.com"
4-
NEXT_PUBLIC_LambdaFunctionUrl="https://d4nnw44cddanflk7kv3r3xbbke0uvnis.lambda-url.us-west-2.on.aws/"
5-
NEXT_PUBLIC_CloudFrontDistributionUrl="https://dthdcw7dsiu7v.cloudfront.net"
6-
NEXT_PUBLIC_ApiEndpoint="https://dthdcw7dsiu7v.cloudfront.net"
7-
NEXT_PUBLIC_CognitoUserPoolId="us-west-2_MIQhmcA5v"
8-
NEXT_PUBLIC_CognitoUserPoolClientId="7covdgpck9g0qlj93fm93n0pnj"
3+
NEXT_PUBLIC_ApiGatewayUrl="https://obuoc4bs0c.execute-api.us-west-2.amazonaws.com"
4+
NEXT_PUBLIC_LambdaFunctionUrl="https://2sczp4fme2sm3v7m2yo5mtcoky0vtvbl.lambda-url.us-west-2.on.aws/"
5+
NEXT_PUBLIC_CloudFrontDistributionUrl="https://d3azwsvxpl4x8e.cloudfront.net"
6+
NEXT_PUBLIC_ApiEndpoint="https://d3azwsvxpl4x8e.cloudfront.net"
7+
NEXT_PUBLIC_CognitoUserPoolId="us-west-2_5SWtxqJvA"
8+
NEXT_PUBLIC_CognitoUserPoolClientId="7hdsj1dcn6esir5gua9r7tihf"
99
NEXT_PUBLIC_Region="us-west-2"
10-
AMPLIFY_URL="https://development.d12ag1linf6gxb.amplifyapp.com"
10+
AMPLIFY_URL="https://development.d1afcsnpzo7fev.amplifyapp.com"

0 commit comments

Comments
 (0)