sst 2.3.7 → 2.4.1

package/cli/commands/bind.js

@@ -1,11 +1,10 @@
 import path from "path";
 import { VisibleError } from "../../error.js";
-const SITE_CONFIG = {
+const SSR_SITE_CONFIG = {
     NextjsSite: "next.config",
     AstroSite: "astro.config",
     RemixSite: "remix.config",
     SolidStartSite: "vite.config",
-    StaticSite: "vite.config",
     SlsNextjsSite: "next.config",
 };
 export const bind = (program) => program
@@ -18,6 +17,7 @@ export const bind = (program) => program
     const { useBus } = await import("../../bus.js");
     const { useIOT } = await import("../../iot.js");
     const { Colors } = await import("../colors.js");
+    const { Logger } = await import("../../logger.js");
     if (args._[0] === "env") {
         Colors.line(Colors.warning(`Warning: ${Colors.bold(`sst env`)} has been renamed to ${Colors.bold(`sst bind`)}`));
     }
@@ -25,17 +25,18 @@ export const bind = (program) => program
     const bus = useBus();
     const project = useProject();
     const command = args.command?.join(" ");
-    const isFrontend = await isRunningInFrontend();
+    const isSsrSite = await isRunningInSsrSite();
     let p;
     let timer;
-    let metadataCache;
+    let siteConfigCache;
     // Handle missing command
     if (!command) {
-        throw new VisibleError(`Command is required, e.g. sst bind ${isFrontend ? "next dev" : "env"}`);
+        throw new VisibleError(`Command is required, e.g. sst bind ${isSsrSite ? "next dev" : "env"}`);
     }
     // Bind script
     const initialMetadata = await getSiteMetadata();
-    if (!initialMetadata) {
+    if (!initialMetadata && !isSsrSite) {
+        Logger.debug("Running in script mode.");
         return await bindScript();
     }
     // Bind site
@@ -44,33 +45,44 @@ export const bind = (program) => program
     bus.subscribe("stacks.metadata.deleted", () => bindSite("metadata_updated"));
     bus.subscribe("config.secret.updated", (payload) => {
         const secretName = payload.properties.name;
-        if (metadataCache?.secrets === undefined)
+        if (siteConfigCache?.secrets === undefined)
             return;
-        if (!metadataCache.secrets.includes(secretName))
+        if (!siteConfigCache.secrets.includes(secretName))
             return;
         Colors.line(`\n`, `SST secrets have been updated. Restarting \`${command}\`...`);
         bindSite("secrets_updated");
     });
-    async function isRunningInFrontend() {
+    async function isRunningInSsrSite() {
         const { existsAsync } = await import("../../util/fs.js");
-        const results = await Promise.all(Object.values(SITE_CONFIG)
-            .map((config) => [".js", ".cjs", ".mjs", ".ts"].map((ext) => existsAsync(`${config}${ext}`)))
+        const { readFile } = await import("fs/promises");
+        const results = await Promise.all(Object.values(SSR_SITE_CONFIG)
+            .map((config) => [".js", ".cjs", ".mjs", ".ts"].map(async (ext) => {
+            const exists = await existsAsync(`${config}${ext}`);
+            if (exists && config === "vite.config") {
+                const content = await readFile(`${config}${ext}`);
+                return content.includes("solid-start");
+            }
+            return exists;
+        }))
             .flat());
         return results.some(Boolean);
     }
     async function bindSite(reason) {
         // Get metadata
-        const metadata = (reason === "init" ? initialMetadata : await getSiteMetadata());
+        const siteMetadata = (reason === "init"
+            ? initialMetadata
+            : await getSiteMetadataUntilAvailable());
+        const siteConfig = await parseSiteConfig(siteMetadata);
         // Handle rebind due to metadata updated
         if (reason === "metadata_updated") {
-            if (areEnvsSame(metadata.envs, metadataCache?.envs || {}))
+            if (areEnvsSame(siteConfig.envs, siteConfigCache?.envs || {}))
                 return;
             Colors.line(`\n`, `SST resources have been updated. Restarting \`${command}\`...`);
         }
-        metadataCache = metadata;
+        siteConfigCache = siteConfig;
         // Assume function's role credentials
-        if (metadata.role) {
-            const credentials = await assumeSsrRole(metadata.role);
+        if (siteConfig.role) {
+            const credentials = await assumeSsrRole(siteConfig.role);
             if (credentials) {
                 // refresh crecentials 1 minute before expiration
                 const expireAt = credentials.Expiration.getTime() - 60000;
@@ -80,7 +92,7 @@ export const bind = (program) => program
                     bindSite("iam_expired");
                 }, expireAt - Date.now());
                 runCommand({
-                    ...metadata.envs,
+                    ...siteConfig.envs,
                     AWS_ACCESS_KEY_ID: credentials.AccessKeyId,
                     AWS_SECRET_ACCESS_KEY: credentials.SecretAccessKey,
                     AWS_SESSION_TOKEN: credentials.SessionToken,
@@ -90,7 +102,7 @@ export const bind = (program) => program
         }
         // Fallback to use local IAM credentials
         runCommand({
-            ...metadata.envs,
+            ...siteConfig.envs,
             ...(await localIamCredentials()),
         });
     }
@@ -101,24 +113,30 @@ export const bind = (program) => program
             ...(await localIamCredentials()),
         });
     }
-    async function getSiteMetadata() {
-        const { metadata } = await import("../../stacks/metadata.js");
-        const { createSpinner } = await import("../spinner.js");
+    async function parseSiteConfig(metadata) {
         const { LambdaClient, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
         const { useAWSClient } = await import("../../credentials.js");
+        const isBindSupported = metadata.type !== "StaticSite" && metadata.type !== "SlsNextjsSite";
+        // Handle StaticSite
+        if (!isBindSupported) {
+            return { envs: metadata.data.environment };
+        }
+        // Get function details
+        const lambda = useAWSClient(LambdaClient);
+        const { Configuration: functionConfig } = await lambda.send(new GetFunctionCommand({
+            FunctionName: metadata.data.server,
+        }));
+        return {
+            role: functionConfig?.Role,
+            envs: functionConfig?.Environment?.Variables || {},
+            secrets: metadata.data.secrets,
+        };
+    }
+    async function getSiteMetadataUntilAvailable() {
+        const { createSpinner } = await import("../spinner.js");
         const spinner = createSpinner({});
         while (true) {
-            const metadataData = await metadata();
-            const data = Object.values(metadataData)
-                .flat()
-                .filter((c) => Boolean(c))
-                .filter((c) => Boolean(SITE_CONFIG[c.type]))
-                .find((c) => path.resolve(project.paths.root, c.data.path) ===
-                process.cwd());
-            // Do not retry if not running in frontend
-            if (!data && !isFrontend) {
-                return;
-            }
+            const data = await getSiteMetadata();
             // Handle site metadata not found
             if (!data) {
                 spinner.start(
@@ -137,25 +155,20 @@ export const bind = (program) => program
                 continue;
             }
             spinner.isSpinning && spinner.stop().clear();
-            // Handle StaticSite
-            if (!isBindSupported) {
-                return { envs: data.data.environment };
-            }
-            // Get function details
-            const lambda = useAWSClient(LambdaClient);
-            const { Configuration: functionConfig } = await lambda.send(new GetFunctionCommand({
-                FunctionName: data.data.server,
-            }));
-            return {
-                role: functionConfig?.Role,
-                envs: functionConfig?.Environment?.Variables || {},
-                secrets: data.data.secrets,
-            };
+            return data;
         }
     }
+    async function getSiteMetadata() {
+        const { metadata } = await import("../../stacks/metadata.js");
+        const metadataData = await metadata();
+        return Object.values(metadataData)
+            .flat()
+            .filter((c) => Boolean(c))
+            .filter((c) => c.type === "StaticSite" || Boolean(SSR_SITE_CONFIG[c.type]))
+            .find((c) => path.resolve(project.paths.root, c.data.path) === process.cwd());
+    }
     async function assumeSsrRole(roleArn) {
         const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-        const { Logger } = await import("../../logger.js");
         const { useAWSClient } = await import("../../credentials.js");
         const sts = useAWSClient(STSClient);
         const assumeRole = async (duration) => {
@@ -184,7 +197,7 @@ export const bind = (program) => program
                 err = e;
             }
         }
-        Colors.line(Colors.warning(`Failed to assume SSR role ${roleArn}. Falling back to using local IAM credentials.`));
+        Colors.line("Using local IAM credentials since `sst dev` is not running.");
         Logger.debug(`Failed to assume ${roleArn}.`, err);
     }
     async function localIamCredentials() {

package/constructs/EdgeFunction.js

@@ -2,6 +2,7 @@ import fs from "fs";
 import url from "url";
 import path from "path";
 import crypto from "crypto";
+import spawn from "cross-spawn";
 import { Construct } from "constructs";
 import { Effect, Role, Policy, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import { Version, Code, Runtime, Function as CdkFunction, } from "aws-cdk-lib/aws-lambda";
@@ -135,9 +136,20 @@ export class EdgeFunction extends Construct {
         const filePath = path.join(bundle, handlerFilename);
         const fileData = fs.readFileSync(filePath, "utf8");
         fs.writeFileSync(filePath, `process.env = { ...process.env, ..."{{ _SST_FUNCTION_ENVIRONMENT_ }}" };\n${fileData}`);
+        // Note: cannot point the bundle to the `.open-next/server-function`
+        //       b/c the folder contains node_modules. And pnpm node_modules
+        //       contains symlinks. CDK cannot zip symlinks correctly.
+        //       https://github.com/aws/aws-cdk/issues/9251
+        //       We will zip the folder ourselves.
+        const outputPath = path.resolve(useProject().paths.artifacts, `SsrFunction-${this.node.id}-${this.node.addr}`);
+        const script = path.resolve(__dirname, "../support/ssr-site-function-archiver.mjs");
+        const result = spawn.sync("node", [script, path.join(bundle), path.join(outputPath, "server-function.zip")], { stdio: "inherit" });
+        if (result.status !== 0) {
+            throw new Error(`There was a problem generating the assets package.`);
+        }
         // Create asset
         const asset = new Asset(this.scope, `FunctionAsset`, {
-            path: bundle,
+            path: path.join(outputPath, "server-function.zip"),
         });
         return { handlerFilename, asset };
     }

package/constructs/NextjsSite.d.ts

@@ -1,9 +1,10 @@
 import { Construct } from "constructs";
 import { Function as CdkFunction } from "aws-cdk-lib/aws-lambda";
-import { Distribution, CachePolicy } from "aws-cdk-lib/aws-cloudfront";
+import { Distribution } from "aws-cdk-lib/aws-cloudfront";
+import { EdgeFunction } from "./EdgeFunction.js";
 import { SsrSite, SsrSiteProps } from "./SsrSite.js";
 import { Size } from "./util/size.js";
-export interface NextjsSiteProps extends Omit<SsrSiteProps, "edge" | "nodejs"> {
+export interface NextjsSiteProps extends Omit<SsrSiteProps, "nodejs"> {
     imageOptimization?: {
         /**
          * The amount of memory in MB allocated for image optimization function.
@@ -43,9 +44,15 @@ export declare class NextjsSite extends SsrSite {
         clientBuildVersionedSubDir: string;
     };
     protected createFunctionForRegional(): CdkFunction;
-    private createImageOptimizationFunctionForRegional;
-    private createMiddlewareEdgeFunctionForRegional;
+    protected createFunctionForEdge(): EdgeFunction;
+    private createImageOptimizationFunction;
     protected createCloudFrontDistributionForRegional(): Distribution;
-    protected createCloudFrontServerCachePolicy(): CachePolicy;
+    protected createCloudFrontDistributionForEdge(): Distribution;
+    private buildServerBehaviorForRegional;
+    private buildServerBehaviorForEdge;
+    private buildImageBehavior;
+    private buildStaticFileBehavior;
+    private buildDefaultNextjsBehaviorForRegional;
+    private buildDefaultNextjsBehaviorForEdge;
     protected generateBuildId(): string;
 }

package/constructs/NextjsSite.js

@@ -4,7 +4,7 @@ import path from "path";
 import { Fn, Duration as CdkDuration, RemovalPolicy } from "aws-cdk-lib";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { Function as CdkFunction, Code, Runtime, Architecture, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
-import { Distribution, ViewerProtocolPolicy, AllowedMethods, LambdaEdgeEventType, CachedMethods, CachePolicy, CacheQueryStringBehavior, CacheCookieBehavior, CacheHeaderBehavior, } from "aws-cdk-lib/aws-cloudfront";
+import { Distribution, ViewerProtocolPolicy, AllowedMethods, LambdaEdgeEventType, CachedMethods, CachePolicy, } from "aws-cdk-lib/aws-cloudfront";
 import { S3Origin, HttpOrigin, OriginGroup, } from "aws-cdk-lib/aws-cloudfront-origins";
 import { SsrFunction } from "./SsrFunction.js";
 import { EdgeFunction } from "./EdgeFunction.js";
@@ -26,7 +26,7 @@ const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
 export class NextjsSite extends SsrSite {
     constructor(scope, id, props) {
         super(scope, id, {
-            buildCommand: "npx --yes open-next@latest build",
+            buildCommand: "npx --yes open-next@^0.8.0 build",
             ...props,
         });
     }
@@ -54,7 +54,20 @@ export class NextjsSite extends SsrSite {
         });
         return ssrFn.function;
     }
-    createImageOptimizationFunctionForRegional() {
+    createFunctionForEdge() {
+        const { runtime, timeout, memorySize, bind, permissions, environment } = this.props;
+        return new EdgeFunction(this, "ServerFunction", {
+            bundle: path.join(this.props.path, ".open-next", "server-function"),
+            handler: "index.handler",
+            runtime,
+            timeout,
+            memorySize,
+            bind,
+            permissions,
+            environment,
+        });
+    }
+    createImageOptimizationFunction() {
         const { imageOptimization, path: sitePath } = this.props;
         return new CdkFunction(this, `ImageFunction`, {
             description: "Image optimization handler for Next.js",
@@ -83,86 +96,7 @@ export class NextjsSite extends SsrSite {
             ],
         });
     }
-    createMiddlewareEdgeFunctionForRegional() {
-        const { permissions, environment, path: sitePath } = this.props;
-        const middlewarePath = path.resolve(sitePath, ".open-next/middleware-function");
-        if (fs.existsSync(middlewarePath)) {
-            return new EdgeFunction(this, "Middleware", {
-                bundle: middlewarePath,
-                handler: "index.handler",
-                runtime: "nodejs18.x",
-                timeout: 5,
-                memorySize: 128,
-                permissions,
-                environment,
-                nodejs: {
-                    format: "esm",
-                },
-            });
-        }
-    }
     createCloudFrontDistributionForRegional() {
-        const { cdk } = this.props;
-        const cfDistributionProps = cdk?.distribution || {};
-        const s3Origin = new S3Origin(this.cdk.bucket);
-        // Create server behavior
-        const middlewareFn = this.createMiddlewareEdgeFunctionForRegional();
-        const serverFnUrl = this.serverLambdaForRegional.addFunctionUrl({
-            authType: FunctionUrlAuthType.NONE,
-        });
-        const serverBehavior = {
-            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-            origin: new HttpOrigin(Fn.parseDomainName(serverFnUrl.url)),
-            allowedMethods: AllowedMethods.ALLOW_ALL,
-            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
-            compress: true,
-            cachePolicy: cdk?.serverCachePolicy ?? this.createCloudFrontServerCachePolicy(),
-            edgeLambdas: middlewareFn && [
-                {
-                    eventType: LambdaEdgeEventType.VIEWER_REQUEST,
-                    functionVersion: middlewareFn.currentVersion,
-                },
-            ],
-        };
-        // Create image optimization behavior
-        const imageFn = this.createImageOptimizationFunctionForRegional();
-        const imageFnUrl = imageFn.addFunctionUrl({
-            authType: FunctionUrlAuthType.NONE,
-        });
-        const imageBehavior = {
-            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-            origin: new HttpOrigin(Fn.parseDomainName(imageFnUrl.url)),
-            allowedMethods: AllowedMethods.ALLOW_ALL,
-            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
-            compress: true,
-            cachePolicy: serverBehavior.cachePolicy,
-        };
-        // Create statics behavior
-        const staticFileBehaviour = {
-            origin: s3Origin,
-            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-            allowedMethods: AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
-            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
-            compress: true,
-            cachePolicy: CachePolicy.CACHING_OPTIMIZED,
-        };
-        // Create default behavior
-        // default handler for requests that don't match any other path:
-        //   - try lambda handler first
-        //   - if failed, fall back to S3
-        const fallbackOriginGroup = new OriginGroup({
-            primaryOrigin: serverBehavior.origin,
-            fallbackOrigin: s3Origin,
-            fallbackStatusCodes: [404],
-        });
-        const defaultBehavior = {
-            origin: fallbackOriginGroup,
-            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-            compress: true,
-            cachePolicy: serverBehavior.cachePolicy,
-            edgeLambdas: serverBehavior.edgeLambdas,
-            ...(cfDistributionProps.defaultBehavior || {}),
-        };
         /**
          * Next.js requests
          *
@@ -212,6 +146,42 @@ export class NextjsSite extends SsrSite {
          *    - Cache-Control: public, max-age=0, must-revalidate
          *    - x-vercel-cache: MISS
          */
+        const { cdk } = this.props;
+        const cfDistributionProps = cdk?.distribution || {};
+        const s3Origin = new S3Origin(this.cdk.bucket);
+        const serverFnUrl = this.serverLambdaForRegional.addFunctionUrl({
+            authType: FunctionUrlAuthType.NONE,
+        });
+        const serverOrigin = new HttpOrigin(Fn.parseDomainName(serverFnUrl.url));
+        const cachePolicy = cdk?.serverCachePolicy ?? this.buildServerCachePolicy();
+        const originRequestPolicy = this.buildServerOriginRequestPolicy();
+        const serverBehavior = this.buildServerBehaviorForRegional(serverOrigin, cachePolicy, originRequestPolicy);
+        return new Distribution(this, "Distribution", {
+            // these values can be overwritten by cfDistributionProps
+            defaultRootObject: "",
+            // Override props.
+            ...cfDistributionProps,
+            // these values can NOT be overwritten by cfDistributionProps
+            domainNames: this.buildDistributionDomainNames(),
+            certificate: this.cdk.certificate,
+            defaultBehavior: this.buildDefaultNextjsBehaviorForRegional(serverOrigin, s3Origin, cachePolicy, originRequestPolicy),
+            additionalBehaviors: {
+                "api/*": serverBehavior,
+                "_next/data/*": serverBehavior,
+                "_next/image*": this.buildImageBehavior(cachePolicy),
+                "_next/*": this.buildStaticFileBehavior(s3Origin),
+                ...(cfDistributionProps.additionalBehaviors || {}),
+            },
+        });
+    }
+    createCloudFrontDistributionForEdge() {
+        const { cdk } = this.props;
+        const cfDistributionProps = cdk?.distribution || {};
+        const s3Origin = new S3Origin(this.cdk.bucket);
+        const cachePolicy = cdk?.serverCachePolicy ?? this.buildServerCachePolicy();
+        const originRequestPolicy = this.buildServerOriginRequestPolicy();
+        const functionVersion = this.serverLambdaForEdge.currentVersion;
+        const serverBehavior = this.buildServerBehaviorForEdge(functionVersion, s3Origin, cachePolicy, originRequestPolicy);
         return new Distribution(this, "Distribution", {
             // these values can be overwritten by cfDistributionProps
             defaultRootObject: "",
@@ -220,34 +190,111 @@ export class NextjsSite extends SsrSite {
             // these values can NOT be overwritten by cfDistributionProps
             domainNames: this.buildDistributionDomainNames(),
             certificate: this.cdk.certificate,
-            defaultBehavior: defaultBehavior,
+            defaultBehavior: this.buildDefaultNextjsBehaviorForEdge(functionVersion, s3Origin, cachePolicy, originRequestPolicy),
             additionalBehaviors: {
                 "api/*": serverBehavior,
                 "_next/data/*": serverBehavior,
-                "_next/image*": imageBehavior,
-                "_next/*": staticFileBehaviour,
+                "_next/image*": this.buildImageBehavior(cachePolicy),
+                "_next/*": this.buildStaticFileBehavior(s3Origin),
                 ...(cfDistributionProps.additionalBehaviors || {}),
             },
         });
     }
-    createCloudFrontServerCachePolicy() {
-        return new CachePolicy(this, "ServerCache", {
-            queryStringBehavior: CacheQueryStringBehavior.all(),
-            headerBehavior: CacheHeaderBehavior.allowList(
-            // required by image optimization request
-            "accept", 
-            // required by server request
-            "x-op-middleware-request-headers", "x-op-middleware-response-headers", "x-nextjs-data", "x-middleware-prefetch", 
-            // required by server request (in-place routing)
-            "rsc", "next-router-prefetch", "next-router-state-tree"),
-            cookieBehavior: CacheCookieBehavior.all(),
-            defaultTtl: CdkDuration.days(0),
-            maxTtl: CdkDuration.days(365),
-            minTtl: CdkDuration.days(0),
-            enableAcceptEncodingBrotli: true,
-            enableAcceptEncodingGzip: true,
-            comment: "SST server response cache policy",
+    buildServerBehaviorForRegional(serverOrigin, cachePolicy, originRequestPolicy) {
+        return {
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            origin: serverOrigin,
+            allowedMethods: AllowedMethods.ALLOW_ALL,
+            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+            compress: true,
+            cachePolicy,
+            originRequestPolicy,
+        };
+    }
+    buildServerBehaviorForEdge(functionVersion, s3Origin, cachePolicy, originRequestPolicy) {
+        return {
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            origin: s3Origin,
+            allowedMethods: AllowedMethods.ALLOW_ALL,
+            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+            compress: true,
+            cachePolicy,
+            originRequestPolicy,
+            edgeLambdas: [
+                {
+                    includeBody: true,
+                    eventType: LambdaEdgeEventType.ORIGIN_REQUEST,
+                    functionVersion,
+                },
+            ],
+        };
+    }
+    buildImageBehavior(cachePolicy) {
+        const imageFn = this.createImageOptimizationFunction();
+        const imageFnUrl = imageFn.addFunctionUrl({
+            authType: FunctionUrlAuthType.NONE,
         });
+        return {
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            origin: new HttpOrigin(Fn.parseDomainName(imageFnUrl.url)),
+            allowedMethods: AllowedMethods.ALLOW_ALL,
+            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+            compress: true,
+            cachePolicy,
+        };
+    }
+    buildStaticFileBehavior(s3Origin) {
+        return {
+            origin: s3Origin,
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            allowedMethods: AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
+            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+            compress: true,
+            cachePolicy: CachePolicy.CACHING_OPTIMIZED,
+        };
+    }
+    buildDefaultNextjsBehaviorForRegional(serverOrigin, s3Origin, cachePolicy, originRequestPolicy) {
+        // Create default behavior
+        // default handler for requests that don't match any other path:
+        //   - try lambda handler first
+        //   - if failed, fall back to S3
+        const { cdk } = this.props;
+        const cfDistributionProps = cdk?.distribution || {};
+        const fallbackOriginGroup = new OriginGroup({
+            primaryOrigin: serverOrigin,
+            fallbackOrigin: s3Origin,
+            fallbackStatusCodes: [404],
+        });
+        return {
+            origin: fallbackOriginGroup,
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            compress: true,
+            cachePolicy,
+            originRequestPolicy,
+            ...(cfDistributionProps.defaultBehavior || {}),
+        };
+    }
+    buildDefaultNextjsBehaviorForEdge(functionVersion, s3Origin, cachePolicy, originRequestPolicy) {
+        const { cdk } = this.props;
+        const cfDistributionProps = cdk?.distribution || {};
+        return {
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            origin: s3Origin,
+            allowedMethods: AllowedMethods.ALLOW_ALL,
+            cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+            compress: true,
+            cachePolicy,
+            originRequestPolicy,
+            ...(cfDistributionProps.defaultBehavior || {}),
+            edgeLambdas: [
+                {
+                    includeBody: true,
+                    eventType: LambdaEdgeEventType.ORIGIN_REQUEST,
+                    functionVersion,
+                },
+                ...(cfDistributionProps.defaultBehavior?.edgeLambdas || []),
+            ],
+        };
     }
     generateBuildId() {
         const filePath = path.join(this.props.path, ".next/BUILD_ID");

package/constructs/SsrSite.d.ts

@@ -4,7 +4,6 @@ import { Function as CdkFunction, FunctionProps } from "aws-cdk-lib/aws-lambda";
 import { IHostedZone } from "aws-cdk-lib/aws-route53";
 import { Distribution, ICachePolicy, BehaviorOptions, CachePolicy } from "aws-cdk-lib/aws-cloudfront";
 import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
-import { S3Origin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { SSTConstruct } from "./Construct.js";
 import { NodeJSProps, Function } from "./Function.js";
 import { EdgeFunction } from "./EdgeFunction.js";
@@ -198,7 +197,7 @@ export declare class SsrSite extends Construct implements SSTConstruct {
     protected props: SsrSiteNormalizedProps;
     private doNotDeploy;
     protected buildConfig: SsrBuildConfig;
-    private serverLambdaForEdge?;
+    protected serverLambdaForEdge?: EdgeFunction;
     protected serverLambdaForRegional?: CdkFunction;
     private serverLambdaForDev?;
     private bucket;
@@ -264,14 +263,14 @@ export declare class SsrSite extends Construct implements SSTConstruct {
     private createFunctionPermissionsForEdge;
     private validateCloudFrontDistributionSettings;
     protected createCloudFrontDistributionForRegional(): Distribution;
-    private createCloudFrontDistributionForEdge;
+    protected createCloudFrontDistributionForEdge(): Distribution;
     protected buildDistributionDomainNames(): string[];
-    private buildDistributionDefaultBehaviorForRegional;
-    private buildDistributionDefaultBehaviorForEdge;
+    protected buildDefaultBehaviorForRegional(): BehaviorOptions;
+    private buildDefaultBehaviorForEdge;
     private buildBehaviorFunctionAssociations;
-    protected buildDistributionStaticFileBehaviors(origin: S3Origin): Record<string, BehaviorOptions>;
-    protected createCloudFrontServerCachePolicy(): CachePolicy;
-    protected createCloudFrontServerOriginRequestPolicy(): import("aws-cdk-lib/aws-cloudfront").IOriginRequestPolicy;
+    private buildStaticFileBehaviors;
+    protected buildServerCachePolicy(): CachePolicy;
+    protected buildServerOriginRequestPolicy(): import("aws-cdk-lib/aws-cloudfront").IOriginRequestPolicy;
     private createCloudFrontInvalidation;
     protected validateCustomDomainSettings(): void;
     protected lookupHostedZone(): IHostedZone | undefined;