I have an AWS static site in an S3 bucket, accessible through CloudFront and a bunch of lambda functions that form the backend of the site. Is there anything else I can/should do security wise to guard against someone unauthorized running any of the lambda functions? Since I wanted to make sure the webpage didnt offer any additional holes it is behind its own WebACL. Since I know the IP's of my users I set up:
- a web ACL for the API Gateway that allows a whitelist of ips (US-east)
- a web ACL for the CloudFront endpoint that allows the same ips (global)
- a simple lambda login function that matches a hardcoded password. Successful login sets a token which gets passed to a lambda authorizer.