Getting Started

aws s3 mb s3://{bucket} --region {region}
aws s3api put-bucket-versioning --bucket {bucket} \
  --versioning-configuration Status=Enabled --region {region}
aws s3api put-bucket-policy --bucket {bucket} --policy '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": ["s3:GetObject", "s3:GetObjectVersion"],
    "Resource": "arn:aws:s3:::{bucket}/*",
    "Condition": {
      "StringEquals": {"aws:SourceAccount": "{account-id}"},
      "ArnLike": {"aws:SourceArn": "arn:aws:lambda:{region}:{account-id}:web-function/*"}}},
   {"Effect": "Deny", "Principal": "*", "Action": "s3:*",
    "Resource": ["arn:aws:s3:::{bucket}", "arn:aws:s3:::{bucket}/*"],
    "Condition": {"Bool": {"aws:SecureTransport": "false"}}}]
}'

aws iam create-role --role-name {name}-web-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Allow",
      "Principal": {"Service": "lambda.amazonaws.com"},
      "Action": "sts:AssumeRole"}]
  }'
# Logs only — this is all a basic web function needs at runtime:
aws iam attach-role-policy --role-name {name}-web-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

# Add LEAST-PRIVILEGE inline policies ONLY for the AWS services your app calls at runtime,
# scoped to specific resource ARNs. Example — read/write one DynamoDB table:
# aws iam put-role-policy --role-name {name}-web-role --policy-name app-access \
#   --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow",
#     "Action":["dynamodb:GetItem","dynamodb:PutItem"],
#     "Resource":"arn:aws:dynamodb:{region}:{account}:table/{name}-items"}]}'

mkdir my-app && cd my-app
npm init -y && npm pkg set type=module
npm install express

import express from 'express';
const app = express();
app.get('/', (req, res) => res.send('Hello from Web Functions'));
const [HOST, PORT] = (process.env.AWS_LAMBDA_HTTP_ENDPOINT || '0.0.0.0:3000').split(':');
app.listen(PORT, HOST);

node index.js
curl http://localhost:3000/

npm ci --omit=dev
zip -r function.zip index.js package.json node_modules/
aws s3 cp function.zip s3://{bucket}/my-app/function.zip

aws lambda-web create-web-function \
  --function-name my-app \
  --revision-config '{"buildConfig":{"codeConfig":{"s3Object":{"bucket":"{bucket}","key":"my-app/function.zip"}},"runtimeConfig":{"runtime":"nodejs24.x"}},"serviceConfig":{"executionRoleArn":"arn:aws:iam::{account}:role/my-app-web-role"}}' \
  --endpoint-config '{"endpointName":"default","endpointType":"HomeRegion","authType":"ApplicationManaged","autoDeploymentMode":"LatestRevision"}' \
  --region {region}

# Get endpoint URL (wait for state: Active, ~5 min first time)
aws lambda-web get-web-function-endpoint --function-name my-app --endpoint-name default --region {region}
# curl the domainName from the response

aws lambda-web help                                   # not recognised? update the AWS CLI (see deployment.md)
aws lambda-web deploy --name my-app --hello-world --auth-type IamAuth --region {region}    # internal (SigV4 callers only)
aws lambda-web deploy --name my-app --hello-world --region {region}                        # public, only if the user chose it

cd my-app && aws lambda-web deploy --name my-app --code . --region {region}

npm ci --omit=dev
aws lambda-web deploy --name my-app --code . --create --auth-type {auth-type} --region {region}   # IamAuth or ApplicationManaged, as the user chose