Add lambda-microvm-custom-domain-cdk pattern by tanfrank · Pull Request #3292 · aws-samples/serverless-patterns

tanfrank · 2026-08-27T14:06:14Z

Adds a new pattern: Custom domains for AWS Lambda MicroVMs with Application Load Balancer.

Each Lambda MicroVM is served under a domain you own (e.g. .microvms.example.com)
instead of the service-generated .lambda-microvm..on.aws endpoint. Built
entirely from load-balancing/networking primitives — no CloudFront and no compute in the
request path: an ALB rewrites the Host header (host-header-rewrite Transform) and forwards
to the MicroVM service over PrivateLink, with a wildcard ACM cert and Route 53 wildcard record.

Framework: AWS CDK v2 (TypeScript)
Includes: README.md, example-pattern.json, cdk.json, source, and passing tests (13/13).
The optional demo layer (single-page app + provisioning API) can be removed to deploy the
pure networking pattern.

Custom domains for AWS Lambda MicroVMs using an Application Load Balancer Host header rewrite over PrivateLink -- no CloudFront and no compute in the request path. Includes an optional, demo-only single-page app and provisioning API that can be removed to deploy the pure networking pattern. Built with AWS CDK v2 (TypeScript).

bfreiberg · 2026-08-27T15:52:24Z

+    ```
+
+----
+Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.


Suggested change

Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.

bfreiberg · 2026-08-27T15:52:56Z

@@ -0,0 +1,104 @@
+# Custom domains for AWS Lambda MicroVMs with Application Load Balancer


Suggested change

# Custom domains for AWS Lambda MicroVMs with Application Load Balancer

# Custom domains for AWS Lambda MicroVMs with AWS Application Load Balancer

bfreiberg · 2026-08-27T15:53:40Z

+
+This pattern gives each of your [AWS Lambda MicroVMs](https://docs.aws.amazon.com/lambda/latest/dg/lambda-microvms-guide.html) a domain **you** own — e.g. `92cfc7f9-….microvms.example.com` — instead of exposing the service-generated `92cfc7f9-….lambda-microvm-….on.aws` endpoint directly.
+
+It is built entirely from load-balancing and networking primitives: **no CloudFront** and **no compute in the request path** — just an Application Load Balancer (ALB) that rewrites the `Host` header with an [ALB Host header rewrite](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-url-and-host-header-rewrite-with-aws-application-load-balancers/) and forwards to the MicroVM service over AWS PrivateLink. A wildcard ACM certificate and a Route 53 wildcard record cover every MicroVM id under a single base domain.


Suggested change

It is built entirely from load-balancing and networking primitives: **no CloudFront** and **no compute in the request path** — just an Application Load Balancer (ALB) that rewrites the `Host` header with an [ALB Host header rewrite](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-url-and-host-header-rewrite-with-aws-application-load-balancers/) and forwards to the MicroVM service over AWS PrivateLink. A wildcard ACM certificate and a Route 53 wildcard record cover every MicroVM id under a single base domain.

It is built entirely from load-balancing and networking primitives: **no Amazon CloudFront** and **no compute in the request path** — just an Application Load Balancer (ALB) that rewrites the `Host` header with an [ALB Host header rewrite](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-url-and-host-header-rewrite-with-aws-application-load-balancers/) and forwards to the MicroVM service over AWS PrivateLink. A wildcard [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate and a Route 53 wildcard record cover every MicroVM id under a single base domain.

bfreiberg · 2026-08-27T15:55:25Z

+
+Important: this application uses various AWS services and there are costs associated with these services after the Free Tier usage - please see the [AWS Pricing page](https://aws.amazon.com/pricing/) for details. You are responsible for any AWS costs incurred. No warranty is implied in this example.
+
+> ⚠️ **The optional demo layer is DEMO ONLY — NOT PRODUCTION-SAFE.** Its `POST /api/provision` endpoint is completely unauthenticated, it returns auth tokens to the browser, and it uses wide-open CORS (`Access-Control-Allow-Origin: *`). The **core pattern** (`MicroVmCustomDomainsStack`) is production-oriented networking, but before deploying the demo layer, put real authentication in front of the provisioning API, pin CORS to your own origin, and scope IAM and tokens to the minimum. Deploy the demo only in an isolated, non-production account.


Suggested change

> ⚠️ **The optional demo layer is DEMO ONLY — NOT PRODUCTION-SAFE.** Its `POST /api/provision` endpoint is completely unauthenticated, it returns auth tokens to the browser, and it uses wide-open CORS (`Access-Control-Allow-Origin: *`). The **core pattern** (`MicroVmCustomDomainsStack`) is production-oriented networking, but before deploying the demo layer, put real authentication in front of the provisioning API, pin CORS to your own origin, and scope IAM and tokens to the minimum. Deploy the demo only in an isolated, non-production account.

> ⚠️ **The optional demo layer is DEMO ONLY — NOT PRODUCTION-SAFE.** Its `POST /api/provision` endpoint is completely unauthenticated, it returns auth tokens to the browser, and it uses wide-open CORS (`Access-Control-Allow-Origin: *`). The **core pattern** (`MicroVmCustomDomainsStack`) is production-oriented networking, but before deploying the demo layer, at least put real authentication in front of the provisioning API, pin CORS to your own origin, and scope IAM and tokens to the minimum. Deploy the demo only in an isolated, non-production account.

bfreiberg · 2026-08-27T15:55:35Z

+* [Create an AWS account](https://portal.aws.amazon.com/gp/aws/developer/registration/index.html) if you do not already have one and log in. The IAM user that you use must have sufficient permissions to make necessary AWS service calls and manage AWS resources.
+* [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) installed and configured.
+* [Git Installed](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git).
+* [Node.js 18+](https://nodejs.org/en/download/) and [AWS CDK v2](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npx cdk` works; no global install required).


Suggested change

* [Node.js 18+](https://nodejs.org/en/download/) and [AWS CDK v2](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npx cdk` works; no global install required).

* [Node.js 22+](https://nodejs.org/en/download/) and [AWS CDK v2](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npx cdk` works; no global install required).

Node 18 has reached EOL

bfreiberg · 2026-08-27T15:57:45Z

+
+    this.applyHostRewrite(forwardingRule, cfg.customDomainBase, cfg.microvmEndpointBase);
+
+    // --- Route53: wildcard alias to the ALB -------------------------------


Suggested change

// --- Route53: wildcard alias to the ALB -------------------------------

// --- Route 53: wildcard alias to the ALB -------------------------------

bfreiberg · 2026-08-27T15:58:00Z

+ *
+ * Request flow:
+ *   <uuid>.microvms.example.com
+ *     -> Route53 A/AAAA alias (wildcard) -> ALB (TLS, *.customDomainBase cert)


Suggested change

* -> Route53 A/AAAA alias (wildcard) -> ALB (TLS, *.customDomainBase cert)

* -> Route 53 A/AAAA alias (wildcard) -> ALB (TLS, *.customDomainBase cert)

bfreiberg · 2026-08-27T15:58:12Z

+      "account": "111122223333",
+      "region": "us-east-2",
+
+      "//zone": "Existing Route53 public hosted zone that will hold the wildcard record.",


Suggested change

"//zone": "Existing Route53 public hosted zone that will hold the wildcard record.",

"//zone": "Existing Route 53 public hosted zone that will hold the wildcard record.",

bfreiberg · 2026-08-27T16:00:28Z

+          'lambda:GetMicrovm',
+          'lambda:CreateMicrovmAuthToken',
+        ],
+        resources: ['*'], // MicroVM ids are generated at run time; scope by account/region via the execution env.


Can we scope this down to account/region here already?

bfreiberg · 2026-08-27T16:04:07Z

@@ -0,0 +1,65 @@
+{
+  "title": "Custom domains for AWS Lambda MicroVMs with Application Load Balancer",
+  "description": "Serve each AWS Lambda MicroVM under a domain you own using an Application Load Balancer Host header rewrite over PrivateLink, with no CloudFront and no compute in the request path.",


description must be 175 characters or fewer

julianwood assigned julianwood and parikhudit Aug 27, 2026

bfreiberg assigned bfreiberg and unassigned parikhudit Aug 27, 2026

bfreiberg requested changes Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

Add lambda-microvm-custom-domain-cdk pattern - #3292

Add lambda-microvm-custom-domain-cdk pattern#3292
tanfrank wants to merge 1 commit into
aws-samples:mainfrom
tanfrank:lambda-microvm-custom-domain-cdk

tanfrank commented Aug 27, 2026 •

edited

Loading

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

bfreiberg Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
	Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.

		@@ -0,0 +1,104 @@
		# Custom domains for AWS Lambda MicroVMs with Application Load Balancer


		This pattern gives each of your [AWS Lambda MicroVMs](https://docs.aws.amazon.com/lambda/latest/dg/lambda-microvms-guide.html) a domain you own — e.g. `92cfc7f9-….microvms.example.com` — instead of exposing the service-generated `92cfc7f9-….lambda-microvm-….on.aws` endpoint directly.

		It is built entirely from load-balancing and networking primitives: no CloudFront and no compute in the request path — just an Application Load Balancer (ALB) that rewrites the `Host` header with an [ALB Host header rewrite](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-url-and-host-header-rewrite-with-aws-application-load-balancers/) and forwards to the MicroVM service over AWS PrivateLink. A wildcard ACM certificate and a Route 53 wildcard record cover every MicroVM id under a single base domain.


		Important: this application uses various AWS services and there are costs associated with these services after the Free Tier usage - please see the [AWS Pricing page](https://aws.amazon.com/pricing/) for details. You are responsible for any AWS costs incurred. No warranty is implied in this example.

		> ⚠️ The optional demo layer is DEMO ONLY — NOT PRODUCTION-SAFE. Its `POST /api/provision` endpoint is completely unauthenticated, it returns auth tokens to the browser, and it uses wide-open CORS (`Access-Control-Allow-Origin: `). The core pattern* (`MicroVmCustomDomainsStack`) is production-oriented networking, but before deploying the demo layer, put real authentication in front of the provisioning API, pin CORS to your own origin, and scope IAM and tokens to the minimum. Deploy the demo only in an isolated, non-production account.

	* [Node.js 18+](https://nodejs.org/en/download/) and [AWS CDK v2](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npx cdk` works; no global install required).
	* [Node.js 22+](https://nodejs.org/en/download/) and [AWS CDK v2](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npx cdk` works; no global install required).


		this.applyHostRewrite(forwardingRule, cfg.customDomainBase, cfg.microvmEndpointBase);

		// --- Route53: wildcard alias to the ALB -------------------------------

	// --- Route53: wildcard alias to the ALB -------------------------------
	// --- Route 53: wildcard alias to the ALB -------------------------------

	* -> Route53 A/AAAA alias (wildcard) -> ALB (TLS, *.customDomainBase cert)
	* -> Route 53 A/AAAA alias (wildcard) -> ALB (TLS, *.customDomainBase cert)

	"//zone": "Existing Route53 public hosted zone that will hold the wildcard record.",
	"//zone": "Existing Route 53 public hosted zone that will hold the wildcard record.",

Uh oh!

Conversation

tanfrank commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tanfrank commented Aug 27, 2026 •

edited

Loading