Hands-On with the New Amazon CloudFront Support for AWS Lambda Web Functions

On October 12, 2026, Amazon Web Services announced that Lambda Web Functions can now serve as origins for Amazon CloudFront. This feature allows applications running on Lambda Web Functions to be delivered through CloudFront's global edge network without any code changes. By placing CloudFront in front of a Lambda Web Function, applications can take advantage of caching, custom domains with managed TLS certificates, and enhanced security through AWS WAF.

AWS also introduced CloudFront Origin Access Control (OAC) to restrict access to the Lambda Web Function, ensuring that only requests routed through CloudFront reach the origin.

To test this integration, the author created a Lambda Web Function in the ap-southeast-1 region using the Node.js 24.x runtime and the default Hello World template. The Lambda Web Function was configured with IAM authentication (IamAuth) for CloudFront OAC integration, requiring authenticated requests to be invoked. A CloudFront distribution was then created, with the Lambda Web Function endpoint designated as its origin.

The private Lambda function access to CloudFront was enabled through Allow private Lambda function access to CloudFront, and a resource-based policy was added to the Lambda Web Function to grant CloudFront service principal permission to invoke the endpoint, restricting access to the specific distribution using aws:SourceArn.

The author verified the setup by sending requests both directly to the Lambda Web Function endpoint and through the CloudFront distribution. Direct requests resulted in a 403 Forbidden response, expected due to the IAM-signed requirement. However, requests through the CloudFront distribution returned a successful 200 OK response, confirming that the configured origin successfully delivered the requested content.

This setup allows serverless web applications running on Lambda Web Functions to leverage CloudFront's content delivery and security capabilities while maintaining restricted access to the origin through OAC. Such configurations are suitable for serverless web applications requiring custom domains, managed TLS certificates, caching benefits, and additional application-layer security through AWS WAF.

The integration ensures that direct access to the origin is restricted, providing a secure entry point for CloudFront to serve the content.