AWS Lambda@Edge

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

A CloudFront viewer-request function that returns either the request (CloudFront goes on to the cache and origin) or a generated response. Lambda@Edge has no environment variables, so the build bakes the configuration into the bundle; the bundle is well under the 1 MB limit for viewer-request functions.

The site secret is optional and is read from SSM Parameter Store (RG_SECRET_PARAM) with the function’s execution role, which needs ssm:GetParameter and kms:Decrypt. Without it a requireToken rule applies its onError.

# Lambda@Edge has no environment variables, so the build bakes the configuration into the bundle.
RG_SITE_KEY=rgpk_...  RG_SECRET_PARAM=/revokegpt/<site>/secret  RG_PINNED_KEYS_FILE=keys.json \
  pnpm --filter @revokegpt/firewall-lambda-edge bundle   # -> dist/index.mjs, handler "index.handler"

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.