OAC should be enabled when using lambda streaming - Githubissues

sst / ion

❍ — a new engine for SST

https://ion.sst.dev

MIT License

1.11k stars 131 forks source link

OAC should be enabled when using lambda streaming #348

Open ravenscar opened 2 months ago

ravenscar commented 2 months ago

When using a Nextjs site if you enable streaming then the lambdas get publicly accessible URLs for use as origins for the CloudFront distribution.

If you have WAF enabled in your CF you may want to prevent the lambda URLs from being invoked directly via the public url, e.g. not via CF. AWS now supports OAC for lambdas and I think it would be secure to have this enabled by default in this case.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html

JohnnyCrazy commented 3 weeks ago

Hey,

Is this currently being worked on? If not, I would like to try implementing this. Couple of questions I had: Should this be controlled by a parameter? Should it default to enabling oac?