@ashishpandeyone/cdk-lambda-web-function 0.1.4 → 0.1.6

package/API.md

@@ -51,6 +51,7 @@ new NodejsWebFunction(scope: Construct, id: string, props: NodejsWebFunctionProp
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.with">with</a></code> | Applies one or more mixins to this construct. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.applyCrossStackReferenceStrength">applyCrossStackReferenceStrength</a></code> | Override the cross-stack reference strength for this resource. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.grantInvoke">grantInvoke</a></code> | Allows `grantee` to call the endpoint. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.metric">metric</a></code> | A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.metricActiveTime">metricActiveTime</a></code> | Time the execution environments were active (`EnvironmentActiveTime`). |
@@ -60,6 +61,7 @@ new NodejsWebFunction(scope: Construct, id: string, props: NodejsWebFunctionProp
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.metricResponseBytes">metricResponseBytes</a></code> | Bytes sent in responses (`ResponseBytes`). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addEndpoint">addEndpoint</a></code> | Adds an endpoint (up to 10 per function), e.g. a public one next to an IAM-only one, or one pinned to an earlier revision. Each endpoint has its own URL, authentication, regions and limits. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addEnvironment">addEnvironment</a></code> | Adds an environment variable. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission">addPermission</a></code> | Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToRolePolicy">addToRolePolicy</a></code> | Adds a statement to the execution role's policy. |
 
 ---
@@ -135,6 +137,24 @@ account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
 
 ---
 
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`.
+
+The function has one resource policy (`AWS::Lambda::ResourcePolicy`), created on the first statement. This stack
+is its only writer: another stack or template can't also attach one, and changes made outside CloudFormation
+are overwritten by the next update of the policy.
+
+###### `statement`<sup>Required</sup> <a name="statement" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToResourcePolicy.parameter.statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
 ##### `grantInvoke` <a name="grantInvoke" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.grantInvoke"></a>
 
 ```typescript
@@ -293,6 +313,30 @@ Names starting with `AWS_` are reserved.
 
 ---
 
+##### `addPermission` <a name="addPermission" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission"></a>
+
+```typescript
+public addPermission(id: string, permission: WebFunctionPermission): void
+```
+
+Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy.
+
+For a role in this account, use `grantInvoke`.
+
+###### `id`<sup>Required</sup> <a name="id" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission.parameter.id"></a>
+
+- *Type:* string
+
+the statement ID (`Sid`): letters and digits, unique within the function.
+
+---
+
+###### `permission`<sup>Required</sup> <a name="permission" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission.parameter.permission"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission">WebFunctionPermission</a>
+
+---
+
 ##### `addToRolePolicy` <a name="addToRolePolicy" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToRolePolicy"></a>
 
 ```typescript
@@ -713,6 +757,7 @@ new WebFunction(scope: Construct, id: string, props: WebFunctionProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.with">with</a></code> | Applies one or more mixins to this construct. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.applyCrossStackReferenceStrength">applyCrossStackReferenceStrength</a></code> | Override the cross-stack reference strength for this resource. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.grantInvoke">grantInvoke</a></code> | Allows `grantee` to call the endpoint. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.metric">metric</a></code> | A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.metricActiveTime">metricActiveTime</a></code> | Time the execution environments were active (`EnvironmentActiveTime`). |
@@ -722,6 +767,7 @@ new WebFunction(scope: Construct, id: string, props: WebFunctionProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.metricResponseBytes">metricResponseBytes</a></code> | Bytes sent in responses (`ResponseBytes`). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addEndpoint">addEndpoint</a></code> | Adds an endpoint (up to 10 per function), e.g. a public one next to an IAM-only one, or one pinned to an earlier revision. Each endpoint has its own URL, authentication, regions and limits. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addEnvironment">addEnvironment</a></code> | Adds an environment variable. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission">addPermission</a></code> | Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToRolePolicy">addToRolePolicy</a></code> | Adds a statement to the execution role's policy. |
 
 ---
@@ -797,6 +843,24 @@ account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
 
 ---
 
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`.
+
+The function has one resource policy (`AWS::Lambda::ResourcePolicy`), created on the first statement. This stack
+is its only writer: another stack or template can't also attach one, and changes made outside CloudFormation
+are overwritten by the next update of the policy.
+
+###### `statement`<sup>Required</sup> <a name="statement" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToResourcePolicy.parameter.statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
 ##### `grantInvoke` <a name="grantInvoke" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.grantInvoke"></a>
 
 ```typescript
@@ -955,6 +1019,30 @@ Names starting with `AWS_` are reserved.
 
 ---
 
+##### `addPermission` <a name="addPermission" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission"></a>
+
+```typescript
+public addPermission(id: string, permission: WebFunctionPermission): void
+```
+
+Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy.
+
+For a role in this account, use `grantInvoke`.
+
+###### `id`<sup>Required</sup> <a name="id" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission.parameter.id"></a>
+
+- *Type:* string
+
+the statement ID (`Sid`): letters and digits, unique within the function.
+
+---
+
+###### `permission`<sup>Required</sup> <a name="permission" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission.parameter.permission"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission">WebFunctionPermission</a>
+
+---
+
 ##### `addToRolePolicy` <a name="addToRolePolicy" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToRolePolicy"></a>
 
 ```typescript
@@ -1369,6 +1457,7 @@ new WebFunctionBase(scope: Construct, id: string, props?: ResourceProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.with">with</a></code> | Applies one or more mixins to this construct. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.applyCrossStackReferenceStrength">applyCrossStackReferenceStrength</a></code> | Override the cross-stack reference strength for this resource. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the function's resource policy (not added for an imported function). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.grantInvoke">grantInvoke</a></code> | Allows `grantee` to call the function's endpoint. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.metric">metric</a></code> | A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.metricActiveTime">metricActiveTime</a></code> | Time the execution environments were active (`EnvironmentActiveTime`). |
@@ -1450,6 +1539,20 @@ account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
 
 ---
 
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the function's resource policy (not added for an imported function).
+
+###### `statement`<sup>Required</sup> <a name="statement" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.addToResourcePolicy.parameter.statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
 ##### `grantInvoke` <a name="grantInvoke" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.grantInvoke"></a>
 
 ```typescript
@@ -1753,6 +1856,7 @@ Endpoints are created only through `WebFunction`, which owns their log groups in
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.metricRequestThrottles">metricRequestThrottles</a></code> | Requests rejected with 429 because the endpoint reached its `rateLimit` (`EndpointRequestThrottles`). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.metricServerErrorRate">metricServerErrorRate</a></code> | The percentage of requests answered with a 5XX status (math expression; |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.metricServerErrors">metricServerErrors</a></code> | Requests answered with a 5XX status (`HTTPResponseStatusClass5XX`). |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.regionalDomainName">regionalDomainName</a></code> | The domain name of this endpoint in one region. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.regionalUrl">regionalUrl</a></code> | The URL of this endpoint in one region. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.routeTraffic">routeTraffic</a></code> | Routes the endpoint to `revision` instead of the function's current revision, optionally sharing traffic with one more revision (`additionalRevisions`, which gets its weight; |
 
@@ -1950,6 +2054,24 @@ scales up for a sudden burst, not only your application's errors. The metric onl
 
 ---
 
+##### `regionalDomainName` <a name="regionalDomainName" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.regionalDomainName"></a>
+
+```typescript
+public regionalDomainName(region: string): string
+```
+
+The domain name of this endpoint in one region.
+
+Only for `PER_REGION` endpoints.
+
+###### `region`<sup>Required</sup> <a name="region" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.regionalDomainName.parameter.region"></a>
+
+- *Type:* string
+
+one of `regions`.
+
+---
+
 ##### `regionalUrl` <a name="regionalUrl" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.regionalUrl"></a>
 
 ```typescript
@@ -2049,6 +2171,7 @@ Any object.
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.property.regions">regions</a></code> | <code>string[]</code> | Every region the endpoint serves from: the home region first, then the others in alphabetical order. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.property.rollbackAlarms">rollbackAlarms</a></code> | <code>aws-cdk-lib.aws_cloudwatch.IAlarm[]</code> | The alarms this endpoint created for its deployment's `rollbackOn`, one per threshold in every region it serves from (the home region's first). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.property.url">url</a></code> | <code>string</code> | The endpoint's URL: the global URL for `MULTI_REGION`, otherwise the home region's. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.property.webFunction">webFunction</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.IWebFunction">IWebFunction</a></code> | The function this endpoint belongs to. |
 
 ---
 
@@ -2174,6 +2297,18 @@ The endpoint's URL: the global URL for `MULTI_REGION`, otherwise the home region
 
 ---
 
+##### `webFunction`<sup>Required</sup> <a name="webFunction" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint.property.webFunction"></a>
+
+```typescript
+public readonly webFunction: IWebFunction;
+```
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.IWebFunction">IWebFunction</a>
+
+The function this endpoint belongs to.
+
+---
+
 
 ### WebFunctionRevision <a name="WebFunctionRevision" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision"></a>
 
@@ -3635,6 +3770,547 @@ Renaming a function replaces it, and its endpoint gets a new URL.
 
 ---
 
+### WebFunctionOriginProps <a name="WebFunctionOriginProps" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps"></a>
+
+Properties for a Web Function endpoint origin.
+
+#### Initializer <a name="Initializer" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.Initializer"></a>
+
+```typescript
+import { WebFunctionOriginProps } from '@ashishpandeyone/cdk-lambda-web-function'
+
+const webFunctionOriginProps: WebFunctionOriginProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.connectionAttempts">connectionAttempts</a></code> | <code>number</code> | The number of times that CloudFront attempts to connect to the origin; |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.connectionTimeout">connectionTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | The number of seconds that CloudFront waits when trying to establish a connection to the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.customHeaders">customHeaders</a></code> | <code>{[ key: string ]: string}</code> | A list of HTTP header names and values that CloudFront adds to requests it sends to the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originAccessControlId">originAccessControlId</a></code> | <code>string</code> | The unique identifier of an origin access control for this origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originId">originId</a></code> | <code>string</code> | A unique identifier for the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originShieldEnabled">originShieldEnabled</a></code> | <code>boolean</code> | Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originShieldRegion">originShieldRegion</a></code> | <code>string</code> | When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.responseCompletionTimeout">responseCompletionTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | The time that a request from CloudFront to the origin can stay open and wait for a response. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originPath">originPath</a></code> | <code>string</code> | An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.ipAddressType">ipAddressType</a></code> | <code>aws-cdk-lib.aws_cloudfront.OriginIpAddressType</code> | Which IP protocol CloudFront uses to connect to the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.keepaliveTimeout">keepaliveTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | How long CloudFront keeps its connection to the origin open. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.readTimeout">readTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | How long CloudFront waits for a response from the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.region">region</a></code> | <code>string</code> | For a `PER_REGION` endpoint: the region whose URL CloudFront calls. |
+
+---
+
+##### `connectionAttempts`<sup>Optional</sup> <a name="connectionAttempts" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.connectionAttempts"></a>
+
+```typescript
+public readonly connectionAttempts: number;
+```
+
+- *Type:* number
+- *Default:* 3
+
+The number of times that CloudFront attempts to connect to the origin;
+
+valid values are 1, 2, or 3 attempts.
+
+---
+
+##### `connectionTimeout`<sup>Optional</sup> <a name="connectionTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.connectionTimeout"></a>
+
+```typescript
+public readonly connectionTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* Duration.seconds(10)
+
+The number of seconds that CloudFront waits when trying to establish a connection to the origin.
+
+Valid values are 1-10 seconds, inclusive.
+
+---
+
+##### `customHeaders`<sup>Optional</sup> <a name="customHeaders" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.customHeaders"></a>
+
+```typescript
+public readonly customHeaders: {[ key: string ]: string};
+```
+
+- *Type:* {[ key: string ]: string}
+- *Default:* {}
+
+A list of HTTP header names and values that CloudFront adds to requests it sends to the origin.
+
+---
+
+##### `originAccessControlId`<sup>Optional</sup> <a name="originAccessControlId" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originAccessControlId"></a>
+
+```typescript
+public readonly originAccessControlId: string;
+```
+
+- *Type:* string
+- *Default:* no origin access control
+
+The unique identifier of an origin access control for this origin.
+
+---
+
+##### `originId`<sup>Optional</sup> <a name="originId" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originId"></a>
+
+```typescript
+public readonly originId: string;
+```
+
+- *Type:* string
+- *Default:* an originid will be generated for you
+
+A unique identifier for the origin.
+
+This value must be unique within the distribution.
+
+---
+
+##### `originShieldEnabled`<sup>Optional</sup> <a name="originShieldEnabled" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originShieldEnabled"></a>
+
+```typescript
+public readonly originShieldEnabled: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false.
+
+---
+
+##### `originShieldRegion`<sup>Optional</sup> <a name="originShieldRegion" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originShieldRegion"></a>
+
+```typescript
+public readonly originShieldRegion: string;
+```
+
+- *Type:* string
+- *Default:* origin shield not enabled
+
+When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
+
+> [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html)
+
+---
+
+##### `responseCompletionTimeout`<sup>Optional</sup> <a name="responseCompletionTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.responseCompletionTimeout"></a>
+
+```typescript
+public readonly responseCompletionTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* undefined -  AWS CloudFront default is not enforcing a maximum value
+
+The time that a request from CloudFront to the origin can stay open and wait for a response.
+
+If the complete response isn't received from the origin by this time, CloudFront ends the connection.
+
+Valid values are 1-3600 seconds, inclusive.
+
+> [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#response-completion-timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#response-completion-timeout)
+
+---
+
+##### `originPath`<sup>Optional</sup> <a name="originPath" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.originPath"></a>
+
+```typescript
+public readonly originPath: string;
+```
+
+- *Type:* string
+- *Default:* '/'
+
+An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
+
+Must begin, but not end, with '/' (e.g., '/production/images').
+
+---
+
+##### `ipAddressType`<sup>Optional</sup> <a name="ipAddressType" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.ipAddressType"></a>
+
+```typescript
+public readonly ipAddressType: OriginIpAddressType;
+```
+
+- *Type:* aws-cdk-lib.aws_cloudfront.OriginIpAddressType
+- *Default:* OriginIpAddressType.IPV4
+
+Which IP protocol CloudFront uses to connect to the origin.
+
+---
+
+##### `keepaliveTimeout`<sup>Optional</sup> <a name="keepaliveTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.keepaliveTimeout"></a>
+
+```typescript
+public readonly keepaliveTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* Duration.seconds(5)
+
+How long CloudFront keeps its connection to the origin open.
+
+---
+
+##### `readTimeout`<sup>Optional</sup> <a name="readTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.readTimeout"></a>
+
+```typescript
+public readonly readTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* Duration.seconds(30)
+
+How long CloudFront waits for a response from the origin.
+
+Above 120 seconds needs a CloudFront quota increase.
+
+---
+
+##### `region`<sup>Optional</sup> <a name="region" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps.property.region"></a>
+
+```typescript
+public readonly region: string;
+```
+
+- *Type:* string
+- *Default:* the endpoint's home region
+
+For a `PER_REGION` endpoint: the region whose URL CloudFront calls.
+
+Only one region per origin; use an origin
+group or one origin per behavior for more.
+
+---
+
+### WebFunctionOriginWithOacProps <a name="WebFunctionOriginWithOacProps" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps"></a>
+
+Properties for a Web Function endpoint origin with origin access control.
+
+#### Initializer <a name="Initializer" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.Initializer"></a>
+
+```typescript
+import { WebFunctionOriginWithOacProps } from '@ashishpandeyone/cdk-lambda-web-function'
+
+const webFunctionOriginWithOacProps: WebFunctionOriginWithOacProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.connectionAttempts">connectionAttempts</a></code> | <code>number</code> | The number of times that CloudFront attempts to connect to the origin; |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.connectionTimeout">connectionTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | The number of seconds that CloudFront waits when trying to establish a connection to the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.customHeaders">customHeaders</a></code> | <code>{[ key: string ]: string}</code> | A list of HTTP header names and values that CloudFront adds to requests it sends to the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originAccessControlId">originAccessControlId</a></code> | <code>string</code> | The unique identifier of an origin access control for this origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originId">originId</a></code> | <code>string</code> | A unique identifier for the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originShieldEnabled">originShieldEnabled</a></code> | <code>boolean</code> | Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originShieldRegion">originShieldRegion</a></code> | <code>string</code> | When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.responseCompletionTimeout">responseCompletionTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | The time that a request from CloudFront to the origin can stay open and wait for a response. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originPath">originPath</a></code> | <code>string</code> | An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.ipAddressType">ipAddressType</a></code> | <code>aws-cdk-lib.aws_cloudfront.OriginIpAddressType</code> | Which IP protocol CloudFront uses to connect to the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.keepaliveTimeout">keepaliveTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | How long CloudFront keeps its connection to the origin open. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.readTimeout">readTimeout</a></code> | <code>aws-cdk-lib.Duration</code> | How long CloudFront waits for a response from the origin. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.region">region</a></code> | <code>string</code> | For a `PER_REGION` endpoint: the region whose URL CloudFront calls. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originAccessControl">originAccessControl</a></code> | <code>aws-cdk-lib.interfaces.aws_cloudfront.IOriginAccessControlRef</code> | The origin access control. |
+
+---
+
+##### `connectionAttempts`<sup>Optional</sup> <a name="connectionAttempts" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.connectionAttempts"></a>
+
+```typescript
+public readonly connectionAttempts: number;
+```
+
+- *Type:* number
+- *Default:* 3
+
+The number of times that CloudFront attempts to connect to the origin;
+
+valid values are 1, 2, or 3 attempts.
+
+---
+
+##### `connectionTimeout`<sup>Optional</sup> <a name="connectionTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.connectionTimeout"></a>
+
+```typescript
+public readonly connectionTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* Duration.seconds(10)
+
+The number of seconds that CloudFront waits when trying to establish a connection to the origin.
+
+Valid values are 1-10 seconds, inclusive.
+
+---
+
+##### `customHeaders`<sup>Optional</sup> <a name="customHeaders" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.customHeaders"></a>
+
+```typescript
+public readonly customHeaders: {[ key: string ]: string};
+```
+
+- *Type:* {[ key: string ]: string}
+- *Default:* {}
+
+A list of HTTP header names and values that CloudFront adds to requests it sends to the origin.
+
+---
+
+##### `originAccessControlId`<sup>Optional</sup> <a name="originAccessControlId" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originAccessControlId"></a>
+
+```typescript
+public readonly originAccessControlId: string;
+```
+
+- *Type:* string
+- *Default:* no origin access control
+
+The unique identifier of an origin access control for this origin.
+
+---
+
+##### `originId`<sup>Optional</sup> <a name="originId" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originId"></a>
+
+```typescript
+public readonly originId: string;
+```
+
+- *Type:* string
+- *Default:* an originid will be generated for you
+
+A unique identifier for the origin.
+
+This value must be unique within the distribution.
+
+---
+
+##### `originShieldEnabled`<sup>Optional</sup> <a name="originShieldEnabled" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originShieldEnabled"></a>
+
+```typescript
+public readonly originShieldEnabled: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false.
+
+---
+
+##### `originShieldRegion`<sup>Optional</sup> <a name="originShieldRegion" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originShieldRegion"></a>
+
+```typescript
+public readonly originShieldRegion: string;
+```
+
+- *Type:* string
+- *Default:* origin shield not enabled
+
+When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
+
+> [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html)
+
+---
+
+##### `responseCompletionTimeout`<sup>Optional</sup> <a name="responseCompletionTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.responseCompletionTimeout"></a>
+
+```typescript
+public readonly responseCompletionTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* undefined -  AWS CloudFront default is not enforcing a maximum value
+
+The time that a request from CloudFront to the origin can stay open and wait for a response.
+
+If the complete response isn't received from the origin by this time, CloudFront ends the connection.
+
+Valid values are 1-3600 seconds, inclusive.
+
+> [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#response-completion-timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#response-completion-timeout)
+
+---
+
+##### `originPath`<sup>Optional</sup> <a name="originPath" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originPath"></a>
+
+```typescript
+public readonly originPath: string;
+```
+
+- *Type:* string
+- *Default:* '/'
+
+An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
+
+Must begin, but not end, with '/' (e.g., '/production/images').
+
+---
+
+##### `ipAddressType`<sup>Optional</sup> <a name="ipAddressType" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.ipAddressType"></a>
+
+```typescript
+public readonly ipAddressType: OriginIpAddressType;
+```
+
+- *Type:* aws-cdk-lib.aws_cloudfront.OriginIpAddressType
+- *Default:* OriginIpAddressType.IPV4
+
+Which IP protocol CloudFront uses to connect to the origin.
+
+---
+
+##### `keepaliveTimeout`<sup>Optional</sup> <a name="keepaliveTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.keepaliveTimeout"></a>
+
+```typescript
+public readonly keepaliveTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* Duration.seconds(5)
+
+How long CloudFront keeps its connection to the origin open.
+
+---
+
+##### `readTimeout`<sup>Optional</sup> <a name="readTimeout" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.readTimeout"></a>
+
+```typescript
+public readonly readTimeout: Duration;
+```
+
+- *Type:* aws-cdk-lib.Duration
+- *Default:* Duration.seconds(30)
+
+How long CloudFront waits for a response from the origin.
+
+Above 120 seconds needs a CloudFront quota increase.
+
+---
+
+##### `region`<sup>Optional</sup> <a name="region" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.region"></a>
+
+```typescript
+public readonly region: string;
+```
+
+- *Type:* string
+- *Default:* the endpoint's home region
+
+For a `PER_REGION` endpoint: the region whose URL CloudFront calls.
+
+Only one region per origin; use an origin
+group or one origin per behavior for more.
+
+---
+
+##### `originAccessControl`<sup>Optional</sup> <a name="originAccessControl" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps.property.originAccessControl"></a>
+
+```typescript
+public readonly originAccessControl: IOriginAccessControlRef;
+```
+
+- *Type:* aws-cdk-lib.interfaces.aws_cloudfront.IOriginAccessControlRef
+- *Default:* one is created per stack and signing protocol
+
+The origin access control.
+
+It must have origin type `lambda`, signing behavior `always-amz-auth`, and signing
+protocol `sigv4` (a regional endpoint) or `sigv4a` (a `MULTI_REGION` endpoint's global domain). Checked at
+synthesis when it's defined in this app (CDK's `FunctionUrlOriginAccessControl` signs with `always`, which
+CloudFront rejects for Web Function origins).
+
+---
+
+### WebFunctionPermission <a name="WebFunctionPermission" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission"></a>
+
+Permission for a principal outside this account, an AWS service or an organization to call a function's endpoints.
+
+#### Initializer <a name="Initializer" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.Initializer"></a>
+
+```typescript
+import { WebFunctionPermission } from '@ashishpandeyone/cdk-lambda-web-function'
+
+const webFunctionPermission: WebFunctionPermission = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.principal">principal</a></code> | <code>aws-cdk-lib.aws_iam.IPrincipal</code> | Who may call: an account (`iam.AccountPrincipal`), a role or user (`iam.ArnPrincipal`), an AWS service (`iam.ServicePrincipal`, with `sourceArn` or `sourceAccount`) or an organization (`iam.OrganizationPrincipal`). |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.endpoint">endpoint</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a></code> | The endpoint the principal may call. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceAccount">sourceAccount</a></code> | <code>string</code> | For an AWS service: the account that owns the resource calling on its behalf (condition `aws:SourceAccount`). |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceArn">sourceArn</a></code> | <code>string</code> | For an AWS service: the ARN of the resource calling on its behalf (condition `aws:SourceArn`, `ArnLike`), e.g. a CloudFront distribution. Without it or `sourceAccount`, any account's use of the service could call the endpoint. |
+
+---
+
+##### `principal`<sup>Required</sup> <a name="principal" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.principal"></a>
+
+```typescript
+public readonly principal: IPrincipal;
+```
+
+- *Type:* aws-cdk-lib.aws_iam.IPrincipal
+
+Who may call: an account (`iam.AccountPrincipal`), a role or user (`iam.ArnPrincipal`), an AWS service (`iam.ServicePrincipal`, with `sourceArn` or `sourceAccount`) or an organization (`iam.OrganizationPrincipal`).
+
+A principal in another account also needs `lambda:InvokeWebFunctionEndpoint` in its own IAM policy.
+
+---
+
+##### `endpoint`<sup>Optional</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.endpoint"></a>
+
+```typescript
+public readonly endpoint: WebFunctionEndpoint;
+```
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a>
+- *Default:* every endpoint of the function, including ones added later
+
+The endpoint the principal may call.
+
+It must belong to this function.
+
+---
+
+##### `sourceAccount`<sup>Optional</sup> <a name="sourceAccount" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceAccount"></a>
+
+```typescript
+public readonly sourceAccount: string;
+```
+
+- *Type:* string
+- *Default:* no condition
+
+For an AWS service: the account that owns the resource calling on its behalf (condition `aws:SourceAccount`).
+
+---
+
+##### `sourceArn`<sup>Optional</sup> <a name="sourceArn" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceArn"></a>
+
+```typescript
+public readonly sourceArn: string;
+```
+
+- *Type:* string
+- *Default:* no condition
+
+For an AWS service: the ARN of the resource calling on its behalf (condition `aws:SourceArn`, `ArnLike`), e.g. a CloudFront distribution. Without it or `sourceAccount`, any account's use of the service could call the endpoint.
+
+---
+
 ### WebFunctionProps <a name="WebFunctionProps" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps"></a>
 
 Properties for a `WebFunction`.
@@ -4169,6 +4845,9 @@ Allows `grantee` to call the endpoint (`lambda:InvokeWebFunctionEndpoint`).
 The grant is on the endpoint's home-region ARN, which IAM evaluates for every region the
 endpoint serves from, including a MULTI_REGION global URL.
 
+A grantee in the function's account gets an IAM policy statement. Another account or an AWS service also gets
+a statement in the function's resource policy (not for an imported function's endpoints).
+
 ###### `grantee`<sup>Required</sup> <a name="grantee" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants.invoke.parameter.grantee"></a>
 
 - *Type:* aws-cdk-lib.aws_iam.IGrantable
@@ -4178,16 +4857,118 @@ endpoint serves from, including a MULTI_REGION global URL.
 
 
 
+### WebFunctionOrigin <a name="WebFunctionOrigin" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin"></a>
+
+A CloudFront origin for a Web Function endpoint.
+
+Use `WebFunctionOrigin.withOriginAccessControl(endpoint)` for an `AWS_IAM` endpoint: CloudFront signs every request,
+and only your distribution may call the endpoint. `new WebFunctionOrigin(endpoint)` is for a public (`NONE`) endpoint.
+
+#### Initializers <a name="Initializers" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.Initializer"></a>
+
+```typescript
+import { WebFunctionOrigin } from '@ashishpandeyone/cdk-lambda-web-function'
+
+new WebFunctionOrigin(endpoint: WebFunctionEndpoint, props?: WebFunctionOriginProps)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.Initializer.parameter.endpoint">endpoint</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a></code> | *No description.* |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.Initializer.parameter.props">props</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps">WebFunctionOriginProps</a></code> | *No description.* |
+
+---
+
+##### `endpoint`<sup>Required</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.Initializer.parameter.endpoint"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a>
+
+---
+
+##### `props`<sup>Optional</sup> <a name="props" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.Initializer.parameter.props"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginProps">WebFunctionOriginProps</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.bind">bind</a></code> | Binds the origin to the associated Distribution. |
+
+---
+
+##### `bind` <a name="bind" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.bind"></a>
+
+```typescript
+public bind(scope: Construct, options: OriginBindOptions): OriginBindConfig
+```
+
+Binds the origin to the associated Distribution.
+
+Can be used to grant permissions, create dependent resources, etc.
+
+###### `scope`<sup>Required</sup> <a name="scope" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.bind.parameter.scope"></a>
+
+- *Type:* constructs.Construct
+
+---
+
+###### `options`<sup>Required</sup> <a name="options" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.bind.parameter.options"></a>
+
+- *Type:* aws-cdk-lib.aws_cloudfront.OriginBindOptions
+
+---
+
+#### Static Functions <a name="Static Functions" id="Static Functions"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.withOriginAccessControl">withOriginAccessControl</a></code> | An origin for an `AWS_IAM` endpoint, with origin access control: CloudFront signs every request to the endpoint (`always-amz-auth`, which keeps the viewer's `Authorization` header for your application), and the function's resource policy allows `cloudfront.amazonaws.com` to call this endpoint on behalf of this distribution only. |
+
+---
+
+##### `withOriginAccessControl` <a name="withOriginAccessControl" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.withOriginAccessControl"></a>
+
+```typescript
+import { WebFunctionOrigin } from '@ashishpandeyone/cdk-lambda-web-function'
+
+WebFunctionOrigin.withOriginAccessControl(endpoint: WebFunctionEndpoint, props?: WebFunctionOriginWithOacProps)
+```
+
+An origin for an `AWS_IAM` endpoint, with origin access control: CloudFront signs every request to the endpoint (`always-amz-auth`, which keeps the viewer's `Authorization` header for your application), and the function's resource policy allows `cloudfront.amazonaws.com` to call this endpoint on behalf of this distribution only.
+
+The distribution must be in the function's stack.
+
+###### `endpoint`<sup>Required</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.withOriginAccessControl.parameter.endpoint"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a>
+
+---
+
+###### `props`<sup>Optional</sup> <a name="props" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin.withOriginAccessControl.parameter.props"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOriginWithOacProps">WebFunctionOriginWithOacProps</a>
+
+---
+
+
+
 ## Protocols <a name="Protocols" id="Protocols"></a>
 
 ### IWebFunction <a name="IWebFunction" id="@ashishpandeyone/cdk-lambda-web-function.IWebFunction"></a>
 
-- *Extends:* aws-cdk-lib.IResource, aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef
+- *Extends:* aws-cdk-lib.IResource, aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef, aws-cdk-lib.aws_iam.IResourceWithPolicy
 
 - *Implemented By:* <a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction">NodejsWebFunction</a>, <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction">WebFunction</a>, <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase">WebFunctionBase</a>, <a href="#@ashishpandeyone/cdk-lambda-web-function.IWebFunction">IWebFunction</a>
 
 A Lambda Web Function, created in this app (`WebFunction`) or imported (`WebFunction.fromWebFunctionArn`).
 
+`addToResourcePolicy` adds to the function's resource policy (who else may call or manage it). A `WebFunction` has
+one, created by its stack on the first statement. An imported function's policy belongs to the stack that created
+it, so the statement isn't added (`statementAdded: false`).
+
 #### Methods <a name="Methods" id="Methods"></a>
 
 | **Name** | **Description** |
@@ -4212,7 +4993,9 @@ Allows `grantee` to call the function's endpoint (`lambda:InvokeWebFunctionEndpo
 
 for an imported function, the endpoint named in its attributes, or every endpoint.
 
-This adds to the grantee's IAM policy. For a function in another account, its resource policy must also allow the grantee.
+For a `WebFunction`, a grantee in this account gets an IAM policy statement; another account or an AWS service
+also gets a statement in the function's resource policy. For an imported function, only the grantee's IAM policy
+changes: across accounts, the function's own resource policy must also allow the grantee.
 [disable-awslint:no-grants]
 
 ###### `grantee`<sup>Required</sup> <a name="grantee" id="@ashishpandeyone/cdk-lambda-web-function.IWebFunction.grantInvoke.parameter.grantee"></a>