How to restrict access to a lambda

Question

I have a front-end app, the app will be using lambda services, the endpoints have cors enabled like this:

// serverless.yml

functions:
  test:
  handler: functions/test.handler
  events:
  - http:
      path: /test
      method: get
      cors: true

The test function's handler has headers like this:

// ./functions/test.js
headers: {
        'Access-Control-Allow-Origin': 'https://example.com',
    },

When I build/deploy the serverless project, I can put the generated URL in a browser and see the response. The ACAO header does exist and I haven't tried using it from a site, might be blocked there but CORS isn't enough -- it'd be just browser-based, the lambda response will still be visible if requested in other ways.

What I want to do is restrict access to those (production) lambda functions, unless the request is coming from my app, which is (static) hosted in an s3 bucket, bucket's linked to cloudfront, cloudfront's linked to a domain (using route 53 for the domain.

My app won't have users, I just don't want the data that is served there to be accessible from 3rd party services. I thought about building a function that I import inside each function and it would check the IP if state is prod, I'm not sure if it's a good practice though.

What else can I do to protect those lambdas? Solution doesn't have to be in the lambda, maybe there's something in cloudfront I could use, currently there isn't a subdomain api.example.com that will be pointing to the lambdas.

George K · Accepted Answer · 2019-01-21 17:58:24Z

1

Found a solution I like actually, not sure how I didn't think of that before.

In serverless.yml, the resource policy looks like this:

provider:
  name: aws
  runtime: nodejs8.10
  memorySize: 128
  stage: dev
  resourcePolicy:
    - Effect: Allow
      Principal: '*'
      Action: execute-api:Invoke
      Resource:
        - execute-api:/*/*/*
      Condition:
        IpAddress:
          aws:SourceIp:
            - 'your ip here'

When you deploy it, the policy is set in API Gateway -> Your service -> Resource Policy. I'm sure you could add multiple ones if certain lambdas/endpoints should allow different/full access and this way I could also have different IPs based on deployment stage.

answered Jan 21, 2019 at 17:58

George K

2631 gold badge3 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

TheCodingMatt · Accepted Answer · 2021-11-16 14:37:57Z

0

Please note that the resource policy currently only works for the REST API Gateways. https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.html

HTTP APIs do not support resource policies.

answered Nov 16, 2021 at 14:37

TheCodingMatt

612 bronze badges

2 Comments

Bracken Over a year ago

This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review

TheCodingMatt Over a year ago

Yes, I will do it once possible.

Collectives™ on Stack Overflow

How to restrict access to a lambda

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related