Infrastructure As Code

Load this file only when the user asks about CloudFormation or infrastructure-as-code for Lambda Web Functions.

Check the current documentation before creating any CDK or SAM code: the AWS SAM resource reference (opens in a new tab) and the AWS CDK API reference (opens in a new tab). The CloudFormation resources below are what both compile down to.

CloudFormation

Three resources: the function, an immutable revision (code + config), and an HTTPS endpoint weighted to that revision.

{runtime} is the Node.js runtime named in SKILL.md. For an existing function, read the current value from buildConfig.runtimeConfig.runtime with aws lambda-web get-web-function-revision.

You must create the execution role yourself (trust lambda.amazonaws.com, attach AWSLambdaBasicExecutionRole for CloudWatch Logs) — see iam-and-security.md (opens in a new tab).

VPC Egress in a Stack

To reach private VPC resources, add an AWS::Lambda::NetworkConnector and reference it from the revision’s ServiceConfig.EgressNetworkConnectorArn. One stack can own the whole path — the connector does not have to exist first, and you never write a version number by hand. For what a connector does and how to size the subnets, security groups and operator role, see networking.md (opens in a new tab).

Use LatestVersionArn, not Arn. The revision needs a version-qualified ARN (...:network-connector:nc-...:1). !GetAtt Connector.Arn is the unqualified ARN and is rejected by resource-model validation before anything is created.

Creating the connector takes a few minutes, so the stack sits on that resource before the revision starts. Give the endpoint EndpointType: HomeRegion. A connector is Regional, so the API rejects a MultiRegion or PerRegion endpoint that would serve a revision referencing one, and the stack fails on the endpoint resource.

Updating the connector’s configuration publishes a new version, so LatestVersionArn changes, and the next update-stack replaces the revision with one naming the new version and shifts the endpoint to it. The CLI path does not do this: aws lambda-web deploy carries the previous revision’s connector ARN forward verbatim, and that ARN is version-qualified, so a redeploy keeps the old version.

CloudFront-Only Access in a Stack

To let only a CloudFront distribution invoke an IamAuth endpoint, attach the function’s resource-based policy with AWS::Lambda::ResourcePolicy. The property is ResourceArn, set to the web-function ARN; FunctionResourceArn is not a property and CloudFormation rejects it. The distribution’s origin uses an AWS::CloudFront::OriginAccessControl with OriginAccessControlOriginType: lambda and SigningBehavior: always-amz-auth. Why each piece is needed: domains-and-routing.md (opens in a new tab).

aws:SourceArn must be the distribution’s full ARN, so build it with !Sub as above. !Ref Distribution returns only the distribution ID and AWS::CloudFront::Distribution has no Arn attribute, so either form gives a condition that never matches and CloudFront gets 403.

In CDK the generated L1 is CfnResourcePolicy (aws-cdk-lib/aws-lambda), whose property is resourceArn; pass fn.attrFunctionArn from CfnWebFunction. A literal web-function ARN string makes cdk synth warn that ResourceArn does not match the pattern (CloudFormation-Validate::F3017 and F3031), because CDK’s built-in validation carries an older schema; cfn-lint can report the same. The template is valid and the stack deploys; do not switch to a custom resource to set the policy.

CDK

There is no L2 construct for Web Functions. If your aws-cdk-lib has no generated L1 (CfnWebFunction), declare the three resources with the escape hatch, CfnResource, which takes the same property names as the YAML above:

The connector is the exception: aws-cdk-lib does generate CfnNetworkConnector (aws-cdk-lib/aws-lambda), so use it directly rather than a second CfnResource.

Two CDK-specific points:

• A bare name creates no reference, so ordering is yours to declare. In YAML that is DependsOn; in CDK it is addDependency. Without it the revision is created in parallel with the function and fails with ResourceNotFoundException, The function ... does not exist.
• cdk synth and cdk deploy can print warnings that do not mean the template is wrong. Unknown resource type 'AWS::Lambda::WebFunction' (CloudFormation Validate) appears when the installed aws-cdk-lib does not know the type; the deploy still succeeds. On the connector, 'LatestVersionArn' is not one of ['Arn', 'State'] appears because both the generated construct and the type’s published attribute list carry only those two names, while getAtt on LatestVersionArn still resolves and the deploy succeeds. Neither warning is a reason to fall back to the unqualified Arn, which a revision rejects.

S3 Code Bucket

Upload the zip, including node_modules, before deploying — nothing packages the code for you.

• Versioning must be enabled (required by AWS::Lambda::WebFunctionRevision).
• The code artifact is encrypted at rest by default (SSE-S3); for a customer-managed key, see getting-started.md (opens in a new tab). The function’s log group is not encrypted with your own KMS key by default; to associate one, see observability.md (opens in a new tab).
• Bucket policy must grant Lambda read access:

aws:SourceArn must end in /*: the source ARN is under the revision, not the function itself, so the bare function ARN matches nothing and the read is refused.

Gotchas

• Use DependsOn. Without it Cfn could try to create revision or endpoint before the function exists.
• A code change needs a new S3 key or version. Re-uploading over the same key reports “No changes to deploy”. Use a new key (function-v2.zip) or set S3Object.VersionId.
• RevisionWeights is always required on the endpoint, even for a single revision.
• FunctionName must be the bare function name on every resource — never the function ARN. An ARN is accepted at create time and the resources come up, then the endpoint’s DomainName attribute cannot be read: Property '/FunctionName' has value '{arn}' in the resource model but '{name}' in the ARN. That fails the stack, and the rollback fails the same way on the revision, leaving ROLLBACK_FAILED. Recovery takes two calls, because retention is rejected until a delete has already failed: delete-stack to reach DELETE_FAILED, then delete-stack --retain-resources WebFunctionRevision. !GetAtt WebFunctionRevision.RevisionId on the endpoint is fine — the restriction is on FunctionName.
• Do not output the connector’s LatestVersion. It is an integer, and an Output value must be a string: !GetAtt fails the stack with “Every Value member must be a string”, and !Sub '${Connector.LatestVersion}' fails with “does not resolve to a string”. Output LatestVersionArn instead, which is the value a revision needs anyway.

Verify a Stack Deploy

Cleanup