ALB vs Function URL (for Lambda)

Question

Currently, I am hosting my entire web app on AWS Lambda. It has been working great - we manage around a billion HTTP requests every month without any issue.

The Lambda function sits behind an ALB, so the requests flow from ALB --> Lambda in this manner. ALB has some request payload limitations - but it works for us.

Now I am wondering, if its easier to use Lambda Function URL I can put this behind Cloudfront. So, the requests will flow from Cloudfront --> Lambda Function URL --> Lambda instead.

I suppose this will reduce the cost slightly (because lambda function URL is free, compared to ALB), and remove the ALB request payload limitations.

Am I missing something? Is there a downside of using Lambda Function URL (compared to ALB)?

TLDR:

Comparing the following 2 options for a public web app hosted on Lambda:

* ALB --> Lambda
* Cloudfront --> Lambda Function URL --> Lambda

Uri · Accepted Answer

If you don't use any authn/authz, going with Lambda fURLs can be a good idea. You will need to use CloudFront in front if it if you want to expose the a custom domain name for your function. If the responses from your function can be cached, adding a CloudFront distribution can reduce the cost as you may have fewer invocation.

re:Post Agent · Answer

You're on the right track with your thinking, and there are indeed some advantages to using Lambda Function URLs with CloudFront over using an Application Load Balancer (ALB). However, there are also some considerations to keep in mind.

Using CloudFront with Lambda Function URLs can offer several benefits:

1. Cost reduction: As you mentioned, Lambda Function URLs are free, which could lead to cost savings compared to using an ALB.

2. Improved latency: CloudFront's global content distribution network can help reduce latency for users around the world, potentially improving your application's performance.

3. Enhanced security: CloudFront with Origin Access Control (OAC) can provide an additional layer of security by restricting direct access to your Lambda function URL.

4. DDoS protection: You'll receive AWS Shield Standard protection at no additional charge when using CloudFront.

5. Simplified architecture: Removing the ALB can simplify your infrastructure.

However, there are some potential downsides or limitations to consider:

1. Limited advanced features: ALB offers some features that Function URLs don't, such as advanced routing, content-based routing, and integration with AWS WAF.

2. Authentication limitations: While Function URLs support AWS IAM authentication, ALB offers more authentication options, including integration with Amazon Cognito.

3. HTTP method restrictions: When using CloudFront with Function URLs, there are currently limitations with non-GET HTTP methods (like POST, PATCH, PUT) if you want to keep the function URL protected. This is because these methods require signed requests, which external users typically can't provide.

4. Monitoring and metrics: ALB provides more detailed metrics and logging options compared to Function URLs.

5. Multi-function routing: If your application requires routing to multiple Lambda functions based on path or other criteria, an ALB might be more suitable.

Given your current setup handling a billion requests per month, it's crucial to carefully evaluate these trade-offs. If your application primarily uses GET requests and doesn't require advanced routing or authentication features, the CloudFront + Function URL approach could be beneficial. However, if you rely on features provided by ALB or need more flexibility with HTTP methods, you might want to stick with your current setup.

Remember to thoroughly test any changes to your architecture, especially considering your high traffic volume. You may also want to consider a gradual migration to assess the impact on your application's performance and cost.  
**Sources**  
[Select a method to invoke your Lambda function using an HTTP request - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/apig-http-invoke-decision.html)  
[Secure your Lambda function URLs using Amazon CloudFront origin access control | Networking & Content Delivery](https://aws.amazon.com/blogs/networking-and-content-delivery/secure-your-lambda-function-urls-using-amazon-cloudfront-origin-access-control/)  
[Community | Enhancing security for Lambda function URLs](https://community.aws/content/2fuBTcoVg7nnRIVLnqjIsIC8LAi/enhancing-security-for-lambda-function-urls)

ALB vs Function URL (for Lambda)

Relevant content