(CloudFrontToS3): defaults - use cloudfront function instead of lambda@edge for response security headers

[naseemkullah]

Use https://github.com/aws-samples/amazon-cloudfront-functions/blob/main/add-security-headers/index.js for the response security header configuration default instead of lambda@edge

Use Case

See https://github.com/aws-samples/amazon-cloudfront-functions#overview for why this is an improved approach.

Proposed Solution

Replace the default lambda at edge function with the following cloudfront function https://github.com/aws-samples/amazon-cloudfront-functions/blob/main/add-security-headers/index.js

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[biffgaut]

We agree - we already have an internal task looking at making this replacement! :-)

[naseemkullah]

Great to hear @biffgaut!

[naseemkullah]

@biffgaut can you confirm that the function would be appended to any user defined functions in defaultBehavior.functionAssociations ?

[naseemkullah]

One more request 😄 ... that the CSP header values be configurable as mentioned in https://github.com/aws-samples/amazon-cloudfront-functions/tree/main/add-security-headers#add-http-security-headers

Important: Adjust the CSP policy to your specific needs.

Same goes for X-Frame-Options and X-XSS-Protection, though if this is out of scope for the insertHttpSecurityHeaders option, one can merely disable the option and copy paste and adjust https://github.com/aws-samples/amazon-cloudfront-functions/blob/main/add-security-headers/index.js to suit one's needs.

[biffgaut]

Hitendra Nishar is looking at this on our end, I've pinged him to ensure he sees your notes. Our primary goal is to not break existing code, but adding additional optional props is possible.

[naseemkullah]

Hi @hnishar!

For some context, we had to disable the default function (and pass in our own custom security headers cloudfront function based on https://github.com/aws-samples/amazon-cloudfront-functions/blob/main/add-security-headers/index.js), I expect the same for other organizations.

What would make this truly usable is a nice interface for adjusting the various headers, in particular those that https://github.com/aws-samples/amazon-cloudfront-functions/tree/main/add-security-headers#add-http-security-headers mention important to adjust to one's specific needs.

[ranrotx]

I'm not sure if this should be a separate issue, but it would be great to be able to leverage CloudFront Functions for re-writing vanity URLs (such as example.com/about or example.com/about/) to reference a valid key when fetching via the REST API from S3 as required when using CloudFront Origin Access Identity.