# Use CloudFront Proxy to access Lambda APIs

**URL:** <https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357>\
**Category:** Serverless Framework\
**Created:** [September 21, 2016, 9:40am UTC](https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357 "2016-09-21T09:40:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yishaic](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yishaic/32/154_2.png) [@yishaic](https://forum.serverless.com/u/yishaic)\
**Post date:** [September 21, 2016, 9:40am UTC](https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357/1 "2016-09-21T09:40:23Z")

</div>

Hi,  
I’m using serverless to create APIs that are exposed via Api Gateway. I want a 3rd party vendor to call it via Api Gateway, but he currently has a bug with ssl\_handshake with AWS, probably because of SNI. So I want to expose my Lambda functions in HTTP without SSL.  
So I’ve understood I can use CloudFront for that.  
I wanted to know if anyone did that, and how.  
I saw [this](https://github.com/serverless/serverless/blob/master/docs/02-providers/aws/events/01-apigateway.md#setting-an-http-proxy-on-api-gateway) guide for proxy with ColudFront but I’m fully sure that this is what I’m looking for, and how to customize it for my needs.  
E.g. I have `https://SOMETHING.execute-api.REGION.amazonaws.com/dev/person/info` API that I want to expose with HTTP.

Any help would be appreciated.

Thanks,  
Yishai

---

<div class="post-metadata">

**Author:** ![yishaic](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yishaic/32/154_2.png) [@yishaic](https://forum.serverless.com/u/yishaic)\
**Post date:** [September 22, 2016, 11:30am UTC](https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357/2 "2016-09-22T11:30:50Z")

</div>

In case it would help anyone, I’ve managed to configure what I needed, with much help of [this json](https://github.com/boushley/awsm-cloudfront/blob/master/awsm.json) from the awsm-cloudfront project:

At serverless.yml I’ve added  
resources:  
Resources: ${file(cloudformation-resources.json)}

and the json files consists the following:

```
{
    "CloudFrontDistribution": {
        "Type" : "AWS::CloudFront::Distribution",
        "Properties" : {
            "DistributionConfig" : {
            "DefaultRootObject" : "index.html",
            "Enabled" : true,
            "DefaultCacheBehavior" : {
                "AllowedMethods" : ["GET", "HEAD"],
                "CachedMethods" : ["HEAD", "GET"],
                "ForwardedValues" : {
                    "QueryString" : true
                },
                "MinTTL" : "0",
                "TargetOriginId" : "MY_SERVICE_serverlessdeploymentbucket-ID",
                "ViewerProtocolPolicy" : "allow-all"
            },
            "CacheBehaviors" : [
                {
                    "AllowedMethods" : ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"],
                    "CachedMethods" : ["HEAD", "GET"],
                    "ForwardedValues" : {
                    "QueryString" : true
                    },
                    "MinTTL" : "0",
                    "PathPattern" : "*",
                    "TargetOriginId" : "MY_FUNCTION-api-gateway",
                    "ViewerProtocolPolicy" : "allow-all"
                }
            ],
            "Origins" : [
                {
                "CustomOriginConfig" : {
                    "HTTPSPort" : "443",
                    "OriginProtocolPolicy" : "https-only"
                },
                "DomainName" : "SOMETHING.execute-api.REGION.amazonaws.com",
                "Id" : "MY_FUNCTION-api-gateway",
                "OriginPath" : ""
                },
                {
                "DomainName" : "MY_SERVICE_serverlessdeploymentbucket-ID.s3.amazonaws.com",
                "Id" : "MY_SERVICE_serverlessdeploymentbucket-ID",
                "OriginPath" : "",
                "S3OriginConfig" : {}
                }
            ],
            "PriceClass" : "PriceClass_100"
            }
        }
    }
}

```

The only bummer right now is that I have to specify the s3 bucket name and the api gateway endpoint, so it can be created only after these resources were deployed. If anyone has an idea of how to connect these to the resources I’m _going_ to deploy in the new environment and do not exist yet, I’ll be happy to hear.

---

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [September 22, 2016, 10:42pm UTC](https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357/3 "2016-09-22T22:42:48Z")

</div>

Nice work with the CF setup.

You can get the logical id’s of your bucket and endpoints [from this page in the docs](https://github.com/serverless/serverless/blob/master/docs/02-providers/aws/04-resource-names-reference.md). With that you should be able to use `Ref`s to avoid hardcoding values.

Hope that helps.

---

<div class="post-metadata">

**Author:** ![yishaic](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yishaic/32/154_2.png) [@yishaic](https://forum.serverless.com/u/yishaic)\
**Post date:** [September 25, 2016, 10:58am UTC](https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357/4 "2016-09-25T10:58:03Z")

</div>

Thanks! It helped. In case it would help anyone, here’s the updated json. I still have to check some things but for now it works.

```
{
    "CloudFrontDistribution": {
        "Type" : "AWS::CloudFront::Distribution",
        "Properties" : {
            "DistributionConfig" : {
            "DefaultRootObject" : "",
            "Enabled" : true,
            "DefaultCacheBehavior" : {
                "AllowedMethods" : ["GET", "HEAD"],
                "CachedMethods" : ["HEAD", "GET"],
                "ForwardedValues" : {
                    "QueryString" : true
                },
                "MinTTL" : "0",
                "TargetOriginId" : "MY_SERVICE-${opt:stage}-serverlessdeploymentbucket-s3.amazonaws.com",
                "ViewerProtocolPolicy" : "allow-all"
            },
            "CacheBehaviors" : [
                {
                    "AllowedMethods" : ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"],
                    "CachedMethods" : ["HEAD", "GET"],
                    "ForwardedValues" : {
                    "QueryString" : true
                    },
                    "MinTTL" : "0",
                    "PathPattern" : "*",
                    "TargetOriginId" : "MY_FUNCTION-${opt:stage}-api-gateway",
                    "ViewerProtocolPolicy" : "allow-all"
                }
            ],
            "Origins" : [
                {
                "CustomOriginConfig" : {
                    "HTTPSPort" : "443",
                    "OriginProtocolPolicy" : "https-only"
                },
                "DomainName" : {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "ApiGatewayRestApi"
                            },
                            ".execute-api.us-west-2.amazonaws.com"
                        ]
                    ]
                },
                "Id" : "MY_FUNCTION-${opt:stage}-api-gateway",
                "OriginPath" : ""
                },
                {
                "DomainName" : {
                    "Fn::Join": ["", [{"Ref": "ServerlessDeploymentBucket"}, ".s3.amazonaws.com"]]
                },
                "Id" : "MY_SERVICE-${opt:stage}-serverlessdeploymentbucket-s3.amazonaws.com",
                "OriginPath" : "",
                "S3OriginConfig" : {}
                }
            ],
            "PriceClass" : "PriceClass_100"
            }
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![orfin](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/orfin/32/1075_2.png) [@orfin](https://forum.serverless.com/u/orfin)\
**Post date:** [September 25, 2017, 9:18am UTC](https://forum.serverless.com/t/use-cloudfront-proxy-to-access-lambda-apis/357/5 "2017-09-25T09:18:38Z")

</div>

If anyone is also trying to achieve this, we created and open-sourced plugin that automatically sets-up CloudFront distribution in front of API gateway - [https://github.com/Droplr/serverless-api-cloudfront](https://github.com/Droplr/serverless-api-cloudfront) 🙂  
Greetings!