AWS ile Edge Computing: CloudFront Functions vs Lambda@Edge

// Cache key normalizasyonu için CloudFront Functionfunction handler(event) {    var request = event.request;    var querystring = request.querystring;
    // Device indicator'larını standart formata normalize et    if (querystring.device) {        var deviceValue = querystring.device.value.toLowerCase();        if (deviceValue === 'm' || deviceValue === 'mobile') {            querystring.device.value = 'mobile';        } else if (deviceValue === 'd' || deviceValue === 'desktop') {            querystring.device.value = 'desktop';        }    }
    // Query parameter'ları alfabetik sırala - tutarlı cache key için    var sortedQuerystring = {};    Object.keys(querystring)        .sort()        .forEach(function(key) {            sortedQuerystring[key] = querystring[key];        });
    request.querystring = sortedQuerystring;
    // Accept-Encoding header'ını normalize et    if (request.headers['accept-encoding']) {        var acceptEncoding = request.headers['accept-encoding'].value;        if (acceptEncoding.includes('br')) {            request.headers['accept-encoding'].value = 'br,gzip';        } else if (acceptEncoding.includes('gzip')) {            request.headers['accept-encoding'].value = 'gzip';        }    }
    return request;}

// Security header'ları için CloudFront Function (viewer response)function handler(event) {    var response = event.response;    var headers = response.headers;
    // Strict-Transport-Security (HSTS)    headers['strict-transport-security'] = {        value: 'max-age=31536000; includeSubDomains; preload'    };
    // Content-Security-Policy (CSP)    headers['content-security-policy'] = {        value: "default-src 'self'; img-src 'self' https: data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"    };
    // X-Content-Type-Options    headers['x-content-type-options'] = {        value: 'nosniff'    };
    // X-Frame-Options    headers['x-frame-options'] = {        value: 'DENY'    };
    // X-XSS-Protection    headers['x-xss-protection'] = {        value: '1; mode=block'    };
    // Referrer-Policy    headers['referrer-policy'] = {        value: 'strict-origin-when-cross-origin'    };
    // Permissions-Policy    headers['permissions-policy'] = {        value: 'geolocation=(), microphone=(), camera=()'    };
    return response;}

// A/B testing için KeyValueStore kullanan CloudFront Functionimport cf from 'cloudfront';
const kvsId = 'a1b2c3d4-5678-90ab-cdef-example12345';const kvsHandle = cf.kvs(kvsId);
async function handler(event) {    var request = event.request;    var uri = request.uri;
    // Kullanıcının zaten experiment ataması var mı kontrol et    var cookies = request.cookies;    var experimentCookie = cookies['experiment_variant'];
    var variant;    if (experimentCookie) {        variant = experimentCookie.value;    } else {        // Experiment konfigürasyonunu KeyValueStore'dan al        var experimentConfig = await kvsHandle.get('experiment_homepage');        var config = JSON.parse(experimentConfig);
        // Traffic split'e göre variant ata        var random = Math.random() * 100;        if (random < config.variantA_percentage) {            variant = 'A';        } else if (random < (config.variantA_percentage + config.variantB_percentage)) {            variant = 'B';        } else {            variant = 'C';        }
        // Gelecekteki request'ler için cookie set et        request.cookies['experiment_variant'] = { value: variant };    }
    // URL'i variant'a göre yeniden yaz    if (uri === '/') {        request.uri = `/variants/home-${variant.toLowerCase()}.html`;    }
    return request;}

// Geo-targeting için Lambda@Edge function (viewer request)'use strict';
exports.handler = (event, context, callback) => {    const request = event.Records[0].cf.request;    const headers = request.headers;
    // CloudFront geo header'ları sağlıyor    const country = headers['cloudfront-viewer-country']        ? headers['cloudfront-viewer-country'][0].value        : 'US';
    // Ülkeleri dil tercihlerine map et    const countryToLocale = {        'DE': '/de',        'AT': '/de',        'CH': '/de',        'TR': '/tr',        'FR': '/fr',        'ES': '/es',        'IT': '/it',        'US': '/en',        'GB': '/en',        'CA': '/en'    };
    // Sadece root path'i redirect et    if (request.uri === '/') {        const locale = countryToLocale[country] || '/en';
        // Kullanıcının locale tercihi cookie'si var mı kontrol et        const cookies = headers.cookie || [];        let localePreference = null;
        for (let cookie of cookies) {            const matches = cookie.value.match(/locale=([^;]+)/);            if (matches) {                localePreference = matches[1];                break;            }        }
        // Lokalize edilmiş path'e redirect et        const targetUri = localePreference || locale;
        const response = {            status: '302',            statusDescription: 'Found',            headers: {                'location': [{                    key: 'Location',                    value: targetUri                }],                'cache-control': [{                    key: 'Cache-Control',                    value: 'max-age=3600'                }]            }        };
        callback(null, response);    } else {        callback(null, request);    }};

// JWT validation için Lambda@Edge function (viewer request)'use strict';
const jwt = require('jsonwebtoken');
// Production'da AWS Secrets Manager'dan çekconst JWT_SECRET = process.env.JWT_SECRET;
exports.handler = async (event, context, callback) => {    const request = event.Records[0].cf.request;    const headers = request.headers;
    // Protected path'ler    const protectedPaths = ['/api/', '/dashboard/', '/admin/'];    const isProtected = protectedPaths.some(path => request.uri.startsWith(path));
    if (!isProtected) {        callback(null, request);        return;    }
    // Authorization header'ını çıkar    const authHeader = headers.authorization || headers.Authorization;
    if (!authHeader || authHeader.length === 0) {        callback(null, unauthorizedResponse('Missing authorization header'));        return;    }
    const token = authHeader[0].value.replace('Bearer ', '');
    try {        // JWT token'ı doğrula        const decoded = jwt.verify(token, JWT_SECRET, {            algorithms: ['HS256'],            maxAge: '24h'        });
        // Origin için custom header'lara kullanıcı bilgisi ekle        request.headers['x-user-id'] = [{            key: 'X-User-Id',            value: decoded.userId        }];        request.headers['x-user-email'] = [{            key: 'X-User-Email',            value: decoded.email        }];
        callback(null, request);    } catch (error) {        console.error('JWT validation failed:', error.message);        callback(null, unauthorizedResponse('Invalid or expired token'));    }};
function unauthorizedResponse(message) {    return {        status: '401',        statusDescription: 'Unauthorized',        headers: {            'www-authenticate': [{                key: 'WWW-Authenticate',                value: 'Bearer realm="Access to protected resources"'            }],            'content-type': [{                key: 'Content-Type',                value: 'application/json'            }]        },        body: JSON.stringify({            error: message        })    };}

// Origin selection için Lambda@Edge function (origin request)'use strict';
const https = require('https');
exports.handler = async (event, context, callback) => {    const request = event.Records[0].cf.request;
    // Primary ve secondary origin'ler    const origins = {        primary: {            domainName: 'api-primary.example.com',            port: 443,            protocol: 'https',            path: '/v1'        },        secondary: {            domainName: 'api-secondary.example.com',            port: 443,            protocol: 'https',            path: '/v1'        }    };
    let selectedOrigin = origins.primary;
    // Custom header'a göre route et    const routingHeader = request.headers['x-origin-override'];    if (routingHeader && routingHeader[0].value === 'secondary') {        selectedOrigin = origins.secondary;    }
    // Path'e göre route et    if (request.uri.startsWith('/legacy/')) {        selectedOrigin = origins.secondary;    }
    // Primary origin'i health check yap    try {        const isHealthy = await checkOriginHealth(selectedOrigin.domainName);        if (!isHealthy) {            console.log(`Primary origin ${selectedOrigin.domainName} unhealthy, failing over`);            selectedOrigin = origins.secondary;        }    } catch (error) {        console.error('Health check failed:', error);        selectedOrigin = origins.secondary;    }
    // Request'i seçilen origin ile güncelle    request.origin = {        custom: {            domainName: selectedOrigin.domainName,            port: selectedOrigin.port,            protocol: selectedOrigin.protocol,            path: selectedOrigin.path,            sslProtocols: ['TLSv1.2'],            readTimeout: 30,            keepaliveTimeout: 5,            customHeaders: {}        }    };
    callback(null, request);};
function checkOriginHealth(domainName) {    return new Promise((resolve) => {        const options = {            hostname: domainName,            port: 443,            path: '/health',            method: 'GET',            timeout: 2000        };
        const req = https.request(options, (res) => {            resolve(res.statusCode === 200);        });
        req.on('error', () => resolve(false));        req.on('timeout', () => {            req.destroy();            resolve(false);        });
        req.end();    });}

// KÖTÜ: Handler içinde initialize etexports.handler = async (event) => {    const AWS = require('aws-sdk'); // Yavaş!    const dynamodb = new AWS.DynamoDB.DocumentClient();    // ...};
// İYİ: Handler dışında initialize etconst AWS = require('aws-sdk');const dynamodb = new AWS.DynamoDB.DocumentClient();
exports.handler = async (event) => {    // Warm invocation'larda initialization'ı yeniden kullanır};

// Structured logging ile Lambda@Edge function'use strict';
exports.handler = async (event, context) => {    const request = event.Records[0].cf.request;    const requestId = context.requestId;
    // Kolay parse için structured log    const logContext = {        requestId,        uri: request.uri,        method: request.method,        country: request.headers['cloudfront-viewer-country']?.[0]?.value,        timestamp: new Date().toISOString(),    };
    console.log('REQUEST_START', JSON.stringify(logContext));
    try {        // Logic'in burada        console.log('PROCESSING', JSON.stringify({ ...logContext, step: 'validation' }));
        return request;    } catch (error) {        console.error('ERROR', JSON.stringify({            ...logContext,            error: error.message,            stack: error.stack,        }));        throw error;    } finally {        console.log('REQUEST_END', JSON.stringify(logContext));    }};

const responseBody = JSON.stringify(data);const sizeInBytes = Buffer.byteLength(responseBody, 'utf8');
if (sizeInBytes > 1048576) { // 1 MB = 1048576 byte    console.error(`Response size ${sizeInBytes} 1MB limitini aşıyor`);    // Bunun yerine S3 object referansı dön    return {        status: '200',        body: JSON.stringify({            url: `https://s3.amazonaws.com/bucket/response-${requestId}.json`        })    };}

const timeoutPromise = new Promise((_, reject) =>    setTimeout(() => reject(new Error('Timeout')), 4000));
const result = await Promise.race([    fetchExternalData(),    timeoutPromise]);

function normalizeQueryString(querystring) {    // Tracking parameter'larını kaldır    const trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'fbclid', 'gclid'];    trackingParams.forEach(param => delete querystring[param]);
    // Kalan parameter'ları sırala    const sorted = {};    Object.keys(querystring).sort().forEach(key => {        sorted[key] = querystring[key];    });
    return sorted;}