feat(cloudfront-origins): add ipAddressType property to Lambda Function URL origins #35458

matoom-nomu · 2025-09-10T09:19:10Z

Issue # (if applicable)

Reason for this change

Lambda Function URLs natively support dual-stack IPv4/IPv6 connectivity, but CDK's FunctionUrlOrigin class did not expose the ipAddressType property to configure IP protocol preferences.

Description of changes

Added OriginIpAddressType enum with IPV4, IPV6, and DUALSTACK options
Added optional ipAddressType property to FunctionUrlOriginProps interface using the enum type
Default behavior follows CloudFormation default (IPv4 only) to avoid breaking changes
Updated both FunctionUrlOrigin and FunctionUrlOriginWithOAC classes to pass through the property
Added test coverage for default behavior, explicit value setting, and OAC integration
Updated README with usage examples and enum documentation

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Added unit tests covering default behavior when ipAddressType is not specified
Added unit tests for explicit enum value setting (OriginIpAddressType.IPV4, OriginIpAddressType.IPV6, OriginIpAddressType.DUALSTACK)
Added test with Origin Access Control (OAC)

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…on URL origins with dualstack default

aws-cdk-automation

(This review is outdated)

badmintoncryer

Thank you for your contribution! I've added some advices.

badmintoncryer · 2025-09-10T09:22:51Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

+   *
+   * @default 'dualstack'
+   */
+  readonly ipAddressType?: 'ipv4' | 'ipv6' | 'dualstack';


We cannot use union type in CDK. Could you please define new enum type?

Thanks for the quick review, and sorry for the elementary mistake.
i've added new enum.

badmintoncryer · 2025-09-10T09:28:30Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

@@ -76,6 +85,7 @@ export class FunctionUrlOrigin extends cloudfront.OriginBase {
      originProtocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
      originReadTimeout: this.props.readTimeout?.toSeconds(),
      originKeepaliveTimeout: this.props.keepaliveTimeout?.toSeconds(),
+      ipAddressType: this.props.ipAddressType ?? 'dualstack',


What is the cloudformation default value of ipAddressType? (If we deploy cfn with specifying ipAddressType to undefined, is the IP address type set to dual stack?)

If that default value is not 'dualstack', this modification is a breaking change and you need to implement a feature flag.

What is the cloudformation default value of ipAddressType? (If we deploy cfn with specifying ipAddressType to undefined, is the IP address type set to dual stack?)

I checked in my personal account and if we don't explicitly define IpAddressType in CloudFormation, IpAddressType defaults to IPv4.

If that default value is not 'dualstack', this modification is a breaking change and you need to implement a feature flag.

I have removed the setting that makes dualstack the default and implemented only the ipAddressType property. Although I initially set dualstack as the default based on the description in #35450,
this would be a breaking change, so it might be better to limit this PR just adding the property for now.

Thank you for your confirmation and I agree with your opinion.

… IPv4

badmintoncryer · 2025-09-10T15:06:17Z

Could you please add integ test?

matoom-nomu · 2025-09-11T02:39:46Z

Could you please add integ test?

sorry for being late, i just added integ-test's snapshot.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

badmintoncryer · 2025-09-11T13:27:18Z

packages/aws-cdk-lib/aws-cloudfront-origins/test/function-url-origin.test.ts

+  test('Does not include ipAddressType when not specified (uses CloudFormation default)', () => {
+    const fn = new lambda.Function(stack, 'MyFunction', {
+      code: lambda.Code.fromInline('exports.handler = async () => {};'),
+      handler: 'index.handler',
+      runtime: lambda.Runtime.NODEJS_20_X,
+    });
+
+    const fnUrl = fn.addFunctionUrl({
+      authType: lambda.FunctionUrlAuthType.NONE,
+    });
+
+    const origin = new FunctionUrlOrigin(fnUrl);
+    const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });
+
+    expect(stack.resolve(originBindConfig.originProperty)).toEqual({
+      id: 'StackOriginLambdaFunctionURL',
+      domainName: {
+        'Fn::Select': [2, { 'Fn::Split': ['/', { 'Fn::GetAtt': ['MyFunctionFunctionUrlFF6DE78C', 'FunctionUrl'] }] }],
+      },
+      customOriginConfig: {
+        originProtocolPolicy: 'https-only',
+        originSslProtocols: ['TLSv1.2'],
+      },
+    });
+  });


I think this test is not necessary.

Suggested change

test('Does not include ipAddressType when not specified (uses CloudFormation default)', () => {

const fn = new lambda.Function(stack, 'MyFunction', {

code: lambda.Code.fromInline('exports.handler = async () => {};'),

handler: 'index.handler',

runtime: lambda.Runtime.NODEJS_20_X,

});

const fnUrl = fn.addFunctionUrl({

authType: lambda.FunctionUrlAuthType.NONE,

});

const origin = new FunctionUrlOrigin(fnUrl);

const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });

expect(stack.resolve(originBindConfig.originProperty)).toEqual({

id: 'StackOriginLambdaFunctionURL',

domainName: {

'Fn::Select': [2, { 'Fn::Split': ['/', { 'Fn::GetAtt': ['MyFunctionFunctionUrlFF6DE78C', 'FunctionUrl'] }] }],

},

customOriginConfig: {

originProtocolPolicy: 'https-only',

originSslProtocols: ['TLSv1.2'],

},

});

});

understood,i deleted this test case.

badmintoncryer · 2025-09-11T13:30:12Z

packages/aws-cdk-lib/aws-cloudfront-origins/test/function-url-origin.test.ts

+  test('Correctly sets ipAddressType to dualstack', () => {
+    const fn = new lambda.Function(stack, 'MyFunction', {
+      code: lambda.Code.fromInline('exports.handler = async () => {};'),
+      handler: 'index.handler',
+      runtime: lambda.Runtime.NODEJS_20_X,
+    });
+
+    const fnUrl = fn.addFunctionUrl({
+      authType: lambda.FunctionUrlAuthType.NONE,
+    });
+
+    const origin = new FunctionUrlOrigin(fnUrl, {
+      ipAddressType: OriginIpAddressType.DUALSTACK,
+    });
+
+    const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });
+
+    expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({
+      customOriginConfig: {
+        ipAddressType: OriginIpAddressType.DUALSTACK,
+      },
+    });
+  });
+
+  test('Correctly sets ipAddressType to ipv4', () => {
+    const fn = new lambda.Function(stack, 'MyFunction', {
+      code: lambda.Code.fromInline('exports.handler = async () => {};'),
+      handler: 'index.handler',
+      runtime: lambda.Runtime.NODEJS_20_X,
+    });
+
+    const fnUrl = fn.addFunctionUrl({
+      authType: lambda.FunctionUrlAuthType.NONE,
+    });
+
+    const origin = new FunctionUrlOrigin(fnUrl, {
+      ipAddressType: OriginIpAddressType.IPV4,
+    });
+
+    const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });
+
+    expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({
+      customOriginConfig: {
+        ipAddressType: OriginIpAddressType.IPV4,
+      },
+    });
+  });
+
+  test('Correctly sets ipAddressType to ipv6', () => {
+    const fn = new lambda.Function(stack, 'MyFunction', {
+      code: lambda.Code.fromInline('exports.handler = async () => {};'),
+      handler: 'index.handler',
+      runtime: lambda.Runtime.NODEJS_20_X,
+    });
+
+    const fnUrl = fn.addFunctionUrl({
+      authType: lambda.FunctionUrlAuthType.NONE,
+    });
+
+    const origin = new FunctionUrlOrigin(fnUrl, {
+      ipAddressType: OriginIpAddressType.IPV6,
+    });
+
+    const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });
+
+    expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({
+      customOriginConfig: {
+        ipAddressType: OriginIpAddressType.IPV6,
+      },
+    });
+  });


It is better to aggregate these tests like below.

Suggested change

test('Correctly sets ipAddressType to dualstack', () => {

const fn = new lambda.Function(stack, 'MyFunction', {

code: lambda.Code.fromInline('exports.handler = async () => {};'),

handler: 'index.handler',

runtime: lambda.Runtime.NODEJS_20_X,

});

const fnUrl = fn.addFunctionUrl({

authType: lambda.FunctionUrlAuthType.NONE,

});

const origin = new FunctionUrlOrigin(fnUrl, {

ipAddressType: OriginIpAddressType.DUALSTACK,

});

const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });

expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({

customOriginConfig: {

ipAddressType: OriginIpAddressType.DUALSTACK,

},

});

});

test('Correctly sets ipAddressType to ipv4', () => {

const fn = new lambda.Function(stack, 'MyFunction', {

code: lambda.Code.fromInline('exports.handler = async () => {};'),

handler: 'index.handler',

runtime: lambda.Runtime.NODEJS_20_X,

});

const fnUrl = fn.addFunctionUrl({

authType: lambda.FunctionUrlAuthType.NONE,

});

const origin = new FunctionUrlOrigin(fnUrl, {

ipAddressType: OriginIpAddressType.IPV4,

});

const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });

expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({

customOriginConfig: {

ipAddressType: OriginIpAddressType.IPV4,

},

});

});

test('Correctly sets ipAddressType to ipv6', () => {

const fn = new lambda.Function(stack, 'MyFunction', {

code: lambda.Code.fromInline('exports.handler = async () => {};'),

handler: 'index.handler',

runtime: lambda.Runtime.NODEJS_20_X,

});

const fnUrl = fn.addFunctionUrl({

authType: lambda.FunctionUrlAuthType.NONE,

});

const origin = new FunctionUrlOrigin(fnUrl, {

ipAddressType: OriginIpAddressType.IPV6,

});

const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });

expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({

customOriginConfig: {

ipAddressType: OriginIpAddressType.IPV6,

},

});

});

test.each([OriginIpAddressType.DUALSTACK, OriginIpAddressType.IPV4, OriginIpAddressType.IPV6])('Correctly sets ipAddressType to %s', (ipAddressType) => {

const fn = new lambda.Function(stack, 'MyFunction', {

code: lambda.Code.fromInline('exports.handler = async () => {};'),

handler: 'index.handler',

runtime: lambda.Runtime.NODEJS_20_X,

});

const fnUrl = fn.addFunctionUrl({

authType: lambda.FunctionUrlAuthType.NONE,

});

const origin = new FunctionUrlOrigin(fnUrl, {

ipAddressType,

});

const originBindConfig = origin.bind(stack, { originId: 'StackOriginLambdaFunctionURL' });

expect(stack.resolve(originBindConfig.originProperty)).toMatchObject({

customOriginConfig: {

ipAddressType,

},

});

});

absolutely right, I aggregated testcase as you wrote.

badmintoncryer · 2025-09-11T13:33:41Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts

+/**
+ * IP address type for CloudFront to use when connecting to the origin.
+ */
+export enum OriginIpAddressType {
+  /**
+   * CloudFront uses IPv4 only to connect to the origin.
+   */
+  IPV4 = 'ipv4',
+
+  /**
+   * CloudFront uses IPv6 only to connect to the origin.
+   */
+  IPV6 = 'ipv6',
+
+  /**
+   * CloudFront uses both IPv4 and IPv6 to connect to the origin.
+   */
+  DUALSTACK = 'dualstack',
+}


Because this enum can be used not only fn url origin but also other origins, it might be better to define this enum in cloudfront/origin.ts.

https://github.com/aws/aws-cdk/pull/35445/files#diff-37c2a90cbbc7ef8b599be8e78ed33d7f1d2eb9cffd2f6ea688ea1191dd84301b

I changed it to define this enum in cloudfront/origin.ts. same as your PR.
i really appreciate your specific feedbacks, I learned a lot !

badmintoncryer · 2025-09-11T13:35:46Z

Could you please fix this lint error and merge the newest main branch?

@aws-cdk-testing/framework-integ: /codebuild/output/src419940982/src/actions-runner/_work/aws-cdk/aws-cdk/packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront-origins/test/integ.function-url-origin-ip-address-type.ts
@aws-cdk-testing/framework-integ:   58:4  error  Newline required at end of file but not found  eol-last

…ature/function-url-origin-ip-address-type

badmintoncryer · 2025-09-13T02:45:14Z

Could you please resolve these problems?

…/github.com/matoom-nomu/aws-cdk into feature/function-url-origin-ip-address-type

badmintoncryer

Thanks!

feat(cloudfront-origins): add ipAddressType property to Lambda Functi…

18c74c4

…on URL origins with dualstack default

aws-cdk-automation requested a review from a team September 10, 2025 09:19

github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK p2 labels Sep 10, 2025

aws-cdk-automation previously requested changes Sep 10, 2025

View reviewed changes

badmintoncryer suggested changes Sep 10, 2025

View reviewed changes

matoom-nomu added 2 commits September 10, 2025 21:21

add ipAddressType property with OriginIpAddressType enum, defaults to…

c2cb499

… IPv4

add test explictly set IPV4 as ipAddressType

eb6d98f

add integ-test snapshot

c678a5e

add test-file

4b8875d

badmintoncryer suggested changes Sep 11, 2025

View reviewed changes

matoom-nomu added 2 commits September 12, 2025 13:48

define OriginIpAddressType at origin.ts

14d0393

Merge branch 'main' of https://github.com/matoom-nomu/aws-cdk into fe…

abc351f

…ature/function-url-origin-ip-address-type

matoom-nomu changed the title ~~feat(cloudfront-origins): add ipAddressType property to Lambda Function URL origins with dualstack default~~ feat(cloudfront-origins): add ipAddressType property to Lambda Function URL origins Sep 12, 2025

matoom-nomu added 4 commits September 13, 2025 14:59

fix Linter error about import

01dc688

Merge branch 'main' into feature/function-url-origin-ip-address-type

c384bae

fix OriginIpAddressType import at README

f7806a0

Merge branch 'feature/function-url-origin-ip-address-type' of https:/…

3428e6f

…/github.com/matoom-nomu/aws-cdk into feature/function-url-origin-ip-address-type

badmintoncryer approved these changes Sep 13, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Sep 13, 2025

feat(cloudfront-origins): add ipAddressType property to Lambda Function URL origins #35458

Are you sure you want to change the base?

feat(cloudfront-origins): add ipAddressType property to Lambda Function URL origins #35458

Uh oh!

Conversation

matoom-nomu commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented Sep 10, 2025

Uh oh!

matoom-nomu commented Sep 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

badmintoncryer commented Sep 13, 2025

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

matoom-nomu commented Sep 10, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

badmintoncryer commented Sep 11, 2025 •

edited

Loading