Hacker News Reader

You can and should limit the number of parallel invocations and as a result your maximum bill.

If you want ddos protection and proper rate limiting amazon will happily charge you for it several different ways. Maybe you can hide these urls behind cloudflare if you're penny pinching..

I was thinking the same. What we have here is a security nightmare. You have executable code on globally unique URLs with no protective mechanisms in front of it except for the ability to do IAM. Yikes.

Is it not possible to set the lambda url has an origin in CloudFront and get WAF protection that way?

For all production workloads we typically have cloudfront in front of everything.

Not for WAF. The original article states that you must use API Gateway if you want AWS WAF.