Restrict API Lambda invocation to the CloudFront distribution (#574)

* Adding fix to limit function inovke to Cloudfront distribution

* Removing comments

* Removing cloudfront OAC changes since we can't implement it due to lambda taking POST requests

* Formatting

* Changing the url auth type to NONE

Author: sylviamclaughlin

terragrunt/aws/api/lambda.tf

@@ -23,19 +23,4 @@ module "api" {
 resource "aws_lambda_function_url" "api" {
   function_name      = module.api.function_name
   authorization_type = "NONE"
-}
-
-resource "aws_lambda_permission" "api_invoke_function_url" {
-  statement_id           = "AllowInvokeFunctionUrl"
-  action                 = "lambda:InvokeFunctionUrl"
-  function_name          = module.api.function_name
-  function_url_auth_type = "NONE"
-  principal              = "*"
-}
-
-resource "aws_lambda_permission" "api_invoke_function" {
-  statement_id  = "AllowInvokeFunction"
-  action        = "lambda:InvokeFunction"
-  function_name = module.api.function_name
-  principal     = "*"
-}
+}

terragrunt/aws/cloudfront/cloudfront.tf

@@ -120,4 +120,4 @@ resource "aws_cloudfront_response_headers_policy" "security_headers_api" {
       protection = true
     }
   }
-}
+}

terragrunt/aws/cloudfront/lambda.tf

@@ -0,0 +1,20 @@
+# Restrict invocation of the API Lambda function to this CloudFront distribution.
+# These permissions live in the CloudFront module (rather than the API module) to
+# avoid a circular Terragrunt dependency: the CloudFront distribution depends on
+# the API function URL/name, and these permissions depend on the distribution ARN.
+resource "aws_lambda_permission" "api_invoke_function_url" {
+  statement_id           = "AllowInvokeFunctionUrl"
+  action                 = "lambda:InvokeFunctionUrl"
+  function_name          = var.api_function_name
+  function_url_auth_type = "NONE"
+  principal              = "cloudfront.amazonaws.com"
+  source_arn             = aws_cloudfront_distribution.api.arn
+}
+
+resource "aws_lambda_permission" "api_invoke_function" {
+  statement_id  = "AllowInvokeFunction"
+  action        = "lambda:InvokeFunction"
+  function_name = var.api_function_name
+  principal     = "cloudfront.amazonaws.com"
+  source_arn    = aws_cloudfront_distribution.api.arn
+}