# WebFunction

A Lambda WebFunction L2 construct.

Creates a WebFunction with a revision and endpoint for serving HTTP traffic.

Extends: Construct › Resource › WebFunctionBase › WebFunction
Implements: IResource, IGrantable, IResourceWithPolicyV2, IWebFunction, IEnvironmentAware, IWebFunctionRef, IConstruct, IDependable

- CloudFormation: [`AWS::Lambda::WebFunction`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-webfunction.html)
- L1 type: [`CfnWebFunction`](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.CfnWebFunction.html)
- Source: [`aws-lambda/lib/webfunction.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-lambda/lib/webfunction.ts#L367)
- Type last changed: v2.276.0 · 10 Nov 2026

## Example

```ts
import * as s3 from 'aws-cdk-lib/aws-s3';

declare const codeBucket: s3.IBucket;

new lambda.WebFunction(this, 'PerRegionApi', {
  code: lambda.WebFunctionCode.fromBucket(codeBucket, 'app.zip', 'version-id'),
  runtime: lambda.WebFunctionRuntime.NODEJS_24_X,
  defaultEndpointAuth: lambda.WebFunctionAuthType.IAM_AUTH,
  defaultEndpoint: {
    endpointLocation: lambda.WebFunctionEndpointLocation.perRegion(['us-east-1', 'us-west-2']),
  },
});
```

## Initializer

```ts
new WebFunction(scope: Construct, id: string, props: WebFunctionProps)
```

## Construct Props

- `applicationLogLevel`: [ApplicationLogLevel](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ApplicationLogLevel.html) — The minimum log level for application logs (logs emitted by your code, e.g. `console.log()`, `console.warn()`). Only logs at this level or above will be captured in CloudWatch.

  **Default:** No application log level filtering.

  For example, setting this to `INFO` will capture `console.info()` and
  `console.warn()` but filter out `console.debug()`.

- `code`: [WebFunctionCode](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionCode.html) (required) — The deployment package for the WebFunction.

- `defaultEndpoint`: [WebFunctionDefaultEndpointOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionDefaultEndpointOptions.html) — The other settings of the endpoint the WebFunction creates, `endpoint`.

  **Default:** a home-Region endpoint named `prod`, with no description and no scaling or rate limit beyond your account's quotas

  Endpoints added with `addEndpoint()` take their own settings, auth type included.

- `defaultEndpointAuth`: [WebFunctionAuthType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionAuthType.html) (required) — The authentication type of the endpoint the WebFunction creates, `endpoint`.

  There is no default: you must choose explicitly so an endpoint is never accidentally public or
  accidentally locked down. Specify `WebFunctionAuthType.IAM_AUTH` (Lambda authorizes requests with SigV4/IAM)
  or `WebFunctionAuthType.APPLICATION_MANAGED` (the endpoint is public and your function handles authorization).

  With `IAM_AUTH`, requests must be signed with SigV4 and carry the `X-Amz-Content-SHA256`
  header, also for a request without a body; without it the endpoint returns 403 even for a
  valid signature. A `MULTI_REGION` endpoint is signed with SigV4a, for the Region set `*`.

- `egressNetworkConnector`: [INetworkConnector](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.INetworkConnector.html) — The network connector that gives the function egress into a VPC.

  **Default:** no VPC egress

  The revision pins to the connector's latest version at the time it is created. For a
  connector defined in the same stack, every update to the connector therefore replaces the
  revision as part of that deployment, and traffic moves to the new version with it. To hold
  the function on a fixed version instead — or to use a connector from another stack, whose
  changing version cannot be exported — import the version with
  `NetworkConnector.fromNetworkConnectorVersionArn()`.

  The connector must have been created for `NetworkConnectorComputeType.WEB_FUNCTION`, and
  the endpoint must be `WebFunctionEndpointType.HOME_REGION`.

  The full `INetworkConnector` is required (rather than a ref) because the revision pins to
  `latestVersionArn`, which `INetworkConnectorRef` does not carry.

  [disable-awslint:prefer-ref-interface]

- `entryPoint`: string — The entry file the runtime executes, relative to the root of the deployment package.

  **Default:** the runtime's default entry point, `index.js`

  Only supported for Node.js runtimes. When set, it is passed to the runtime via the reserved
  `AWS_LAMBDA_NODEJS_ENTRYPOINT` environment variable. Do not set that
  variable through `environment` as well.

- `environment`: { [key: string]: string } — Key-value pairs of environment variables to pass to the WebFunction.

  **Default:** No environment variables.

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The KMS key used to encrypt environment variables.

  **Default:** AWS managed key.

  The Lambda service principal is granted the key usage it needs to encrypt
  and decrypt the revision's environment variables.

- `logGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — The CloudWatch log group to send logs to.

  **Default:** A log group is created, named by CloudFormation and retained when the stack is deleted. Read its name from the `logGroup` attribute.

- `maxConcurrencyPerEnvironment`: number — The maximum number of concurrent requests handled by a single execution environment.

  **Default:** the service default of 64 is applied

  Must be an integer between 1 and 128. When omitted, nothing is sent and the service
  applies its default.

- `revisionDescription`: string — A description of the WebFunction revision.

  **Default:** No description.

  Must be 256 characters or fewer.

- `role`: any — The IAM execution role for the WebFunction.

  **Default:** A new role with `AWSLambdaBasicExecutionRole` is created.

- `runtime`: [WebFunctionRuntime](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionRuntime.html) (required) — The runtime environment for the WebFunction.

- `systemLogLevel`: [SystemLogLevel](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.SystemLogLevel.html) — The minimum log level for system logs (logs emitted by the Lambda runtime, e.g. start/end/report lines and runtime errors). Only logs at this level or above will be captured in CloudWatch.

  **Default:** No system log level filtering.

- `tags`: { [key: string]: string } — Tags to apply to the WebFunction.

  **Default:** No tags.

  Only the WebFunction resource carries tags. Its revision and endpoint are not
  taggable, so nothing is applied to them.

- `timeout`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.seconds(30) — The function execution time (in seconds) after which the WebFunction is terminated.

  Must be an integer between 3 and 900 seconds.

- `webFunctionName`: string — The name of the WebFunction.

  **Default:** A unique name is generated by CDK.

  Must be 2 to 64 characters of letters, numbers, hyphens or underscores, starting and
  ending with a letter or number.

## Properties

- `endpoint`: [WebFunctionEndpoint](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.WebFunctionEndpoint.html) — The endpoint the WebFunction creates for itself, configured by the endpoint properties in `WebFunctionProps`.

  Use its `domainName` to send requests, and its `grants` to allow invoking it. Add more
  endpoints with `addEndpoint()`.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `grantPrincipal`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html) — The principal to grant permissions to: the execution role.

- `logGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — The log group the WebFunction sends its logs to: the one passed in `logGroup`, or the one created for it.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class.

- `resource`: [CfnWebFunction](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.CfnWebFunction.html) — The underlying L1 CfnWebFunction resource.

  Use for escape hatches.

- `resourceRevision`: [CfnWebFunctionRevision](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.CfnWebFunctionRevision.html) — The underlying L1 CfnWebFunctionRevision resource.

  Use for escape hatches.

- `revisionArn`: string — The ARN of the WebFunction revision created by this construct.

- `revisionId`: string — The ID of the WebFunction revision created by this construct.

- `role`: [IRoleRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_iam.IRoleRef.html) — The execution role of the WebFunction: the one passed in `role`, or the one created for it.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

- `webFunctionArn`: string — The ARN of the WebFunction.

- `webFunctionName`: string — The name of the WebFunction.

- `webFunctionRef`: [WebFunctionReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_lambda.WebFunctionReference.html) — The function's reference.

  `Ref` on `AWS::Lambda::WebFunction` returns the ARN, so the name is `webFunctionName` rather
  than the L1's `ref`. Resources that should depend on the function take `functionArn`, a
  `GetAtt` on it.

## Methods

- `addEndpoint(id: string, options: WebFunctionEndpointOptions): WebFunctionEndpoint` — Adds an endpoint that serves this function's revision.

  Use it to serve the function under a different auth type or endpoint type than `endpoint`,
  for example a second, `IAM_AUTH` endpoint for a CloudFront origin.

- `addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult` — Adds a statement to the WebFunction's resource-based policy.

  A web function has a single resource-based policy, so all statements are rendered into one
  `AWS::Lambda::ResourcePolicy`. Use it to allow another account, or a service such as
  CloudFront, to invoke the function's endpoints.

  For an imported WebFunction the policy cannot be changed without replacing it, so this adds
  a warning instead and returns `statementAdded: false`.

- `addToRolePolicy(statement: PolicyStatement): void` — Adds a statement to the WebFunction's execution role.

  For an imported WebFunction the role is unknown, so this adds a warning asking for the
  permission to be granted manually instead.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `fromWebFunctionArn(scope: Construct, id: string, webFunctionArn: string): IWebFunction` (static) — Import an existing WebFunction by its ARN.

- `fromWebFunctionAttributes(scope: Construct, id: string, attrs: WebFunctionAttributes): IWebFunction` (static) — Import an existing WebFunction by its attributes.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `isWebFunction(x: any): boolean` (static) — Return whether the given object is a WebFunction.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.