Serverless.js配置Lambda@Edge时指定Origin的问题求助

问题核心 #

Serverless Framework默认会为S3源自动生成带s3/前缀的OriginId（比如s3/AttachmentsBucket），而非你自定义的AttachmentsBucket。要解决这个问题，你需要手动定义CloudFront分发的源配置，绕过框架的自动生成逻辑，同时在Lambda@Edge的事件配置里明确指定自定义OriginId。

具体配置方案 #

1. 手动编写CloudFront分发资源 #

在serverless.yml的resources区块里直接定义CloudFormation格式的CloudFront分发，明确两个源的Id：

• 默认网站源：OriginId设为DefaultBucket
• 附件源：OriginId设为AttachmentsBucket，并配置路径匹配规则/attachments/*

2. 配置Lambda@Edge函数的CloudFront事件 #

在函数的events配置中，直接指定originId: AttachmentsBucket，同时确保函数部署在us-east-1（Lambda@Edge强制要求的区域）。

完整示例配置 #

service: cloudfront-multi-origin

provider:
  name: aws
  runtime: nodejs18.x
  region: us-east-1 # Lambda@Edge必须部署在该区域
  profile: your-aws-profile

resources:
  Resources:
    # 默认网站存储桶
    DefaultWebsiteBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: your-default-website-bucket
        WebsiteConfiguration:
          IndexDocument:
            Suffix: index.html

    # 附件存储桶
    AttachmentsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: your-attachments-bucket

    # CloudFront分发配置
    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          DefaultCacheBehavior:
            TargetOriginId: DefaultBucket
            ViewerProtocolPolicy: redirect-to-https
            CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6 # 官方默认缓存策略
          CacheBehaviors:
            - PathPattern: /attachments/*
              TargetOriginId: AttachmentsBucket
              ViewerProtocolPolicy: redirect-to-https
              CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
              LambdaFunctionAssociations:
                - EventType: viewer-response
                  LambdaFunctionARN: !GetAtt AuthEdgeFunction.Version.Arn
          Origins:
            - Id: DefaultBucket
              DomainName: !GetAtt DefaultWebsiteBucket.RegionalDomainName
              S3OriginConfig:
                OriginAccessIdentity: ''
            - Id: AttachmentsBucket
              DomainName: !GetAtt AttachmentsBucket.RegionalDomainName
              S3OriginConfig:
                OriginAccessIdentity: ''
          Enabled: true
          DefaultRootObject: index.html

functions:
  AuthEdgeFunction:
    handler: src/handler.authHandler
    events:
      - cloudFront:
          eventType: viewer-response
          originId: AttachmentsBucket # 直接指定自定义OriginId
          distributionId: !Ref CloudFrontDistribution
    # Lambda@Edge所需权限角色
    role: EdgeFunctionRole

  Resources:
    EdgeFunctionRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
                  - edgelambda.amazonaws.com
              Action: sts:AssumeRole
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
          - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess

关键注意事项 #

• 必须手动定义CloudFront的Origins和CacheBehaviors，避免Serverless自动生成带s3/前缀的OriginId。
• Lambda@Edge函数必须部署在us-east-1，且需要使用发布的函数版本（Serverless会自动处理版本发布，但需确保配置正确）。
• 存储桶域名使用RegionalDomainName，避免使用过时的全局S3域名。

内容的提问来源于stack exchange，提问作者Ethan Brown