Feature Request: Support OAC between CloudFront and Lambda

[davidw17]

Our organisation are using cdk-nextjs and for our security requirements, it would be beneficial to have OAC implemented between Cloudfront and the Lambdas vs the current edge solution. Now that OAC is available, just raising a feature request item to get this implemented if possible.

See:

cdk-nextjs/src/NextjsDistribution.ts

Line 223 in 2d9c5a3

/**

[francoisdtm]

+1; I would also prefer to have OAC instead of lambda@edge.
I can work on this change; do we want to keep the possibility to have lambda@edge, or move entirely to OAC ?

[davidw17]

I think it would be handy to still be able to use lambda@edge as an option if possible.

[bestickley]

@francoisdtm, I don't think we can move to OAC because it does not support PUT or POST payloads. See the note below from the docs:

If you use PUT or POST methods with your Lambda function URL, your users must include the payload hash value in the x-amz-content-sha256 header when sending the request to CloudFront. Lambda doesn't support unsigned payloads.

If CloudFront allowed selecting different origins per method, then maybe we could for GETs but I don't think that's possible.