IAM And Security

Attach policies for the services your app accesses (DynamoDB, S3, etc). Grant least privilege — scope to the specific actions and resource ARNs the app needs.

Deployer IAM Policy

Actions use the lambda: prefix. Resource ARN: arn:aws:lambda:{region}:{account}:web-function/{name}

Keep the /{name}/* entry alongside the base ARN: endpoint and revision operations target sub-resource ARNs, not the top-level web-function ARN.

A deployer that creates revisions with an egress network connector also needs lambda:PassNetworkConnector (scoped to arn:aws:lambda:{region}:{account}:network-connector:{connector-id}:*; the unqualified connector ARN does not match) and lambda:GetNetworkConnector; see networking.md (opens in a new tab).

Auth Types

authType decides who can reach the endpoint at the network layer. Choose it deliberately — ask the user before deploying.

There is no NONE / unauthenticated-but-not-app-managed option, and there is no built-in WAF. ApplicationManaged does not mean “no security needed” — it means the security is entirely yours to implement.

Security Considerations

Web Functions endpoints are public by default (ApplicationManaged). Treat every public endpoint as internet-exposed and design accordingly.

• The URL is not a secret. Anyone who learns it can send requests. Do not rely on an unguessable domain as an access control.
• App-owned auth. For ApplicationManaged, implement authentication and authorization in the app (validate a JWT / session / API key on every protected route).
• Input validation. Validate and sanitize all request input (path, query, headers, body) — you’re taking raw internet traffic. Guard against injection, oversized payloads, and malformed input.
• Rate limiting / abuse protection. Set throttleConfig.rateLimit on the endpoint to cap requests per second, and cap scalingConfig.maxEnvironments to bound blast radius. That throttle is endpoint-wide, not per-client, so per-client quotas still belong in the app.
• L7 protection (DDoS / bots / WAF). No built-in WAF. For public-facing apps that need L7 DDoS/bot protection, place your own CloudFront distribution (with AWS WAF) in front of the endpoint. To make the distribution the only caller, use an IamAuth endpoint with CloudFront OAC and a resource-based policy → domains-and-routing.md (opens in a new tab).
• Security headers. For browser-facing responses, set standard headers — Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options. Use a middleware like helmet for Express/Fastify rather than setting them by hand.
• Enforce TLS on the code bucket. For production, add a Deny statement on s3:* for both the bucket and its objects conditioned on aws:SecureTransport being false, so artifacts cannot be fetched over plain HTTP.

Further reading: Lambda security best practices (opens in a new tab) and the Well-Architected Security Pillar (opens in a new tab).