Router protection with OAC

Tip

This page is best viewed through the site search or through the AI.

Creates a router with Origin Access Control (OAC) to secure Lambda function URLs behind CloudFront. Direct access to the Lambda URL returns 403.

sst.config.ts

const router = new sst.aws.Router("MyRouter", {
  protection: "oac",
});

const api = new sst.aws.Function("MyApi", {
  handler: "api.handler",
  url: {
    router: { instance: router, path: "/api" },
  },
});

api.ts

export const handler = async (event: any) => {
  return {
    statusCode: 200,
    headers: {
      "Content-Type": "application/json",
    },
    body: JSON.stringify(event.headers),
  };
};

View the full example.