Revision history [back]

There are several measures that can be taken to ensure that only a CloudFront distribution is able to invoke an AWS Lambda function securely:

1. Configure the API Gateway: You can create an API Gateway and configure it to only allow requests from a specific CloudFront distribution. This will ensure that only authorized requests are allowed to invoke the Lambda function.

2. Use an API Key: You can create an API key and attach it to your CloudFront distribution. This will require clients to include the API key in the request headers, otherwise, the request will be rejected.

3. Configure the Lambda Function: You can configure the Lambda function to only accept requests that are signed with an AWS Signature Version 4. This will ensure that only authenticated requests are allowed to invoke the Lambda function.

4. Use AWS WAF: You can create a web access firewall (WAF) and associate it with your CloudFront distribution. This will block requests that do not match specific conditions configured in the WAF.

5. Use IAM Roles: You can use IAM roles to control access to your Lambda function. You can create a role with the appropriate permissions to allow your CloudFront distribution to invoke the function, and then associate the role with the Lambda function. This will ensure that only authorized requests are allowed to invoke the function.