I’m trying to recreate the AWS Image Optimization Example. In the example, the end result is to have a CloudFront Distro sitting on top of your S3 bucket that can do very basic image manipulations using a Lambda@Edge function.

I have an issue where the Lambda@Edge function won’t post console.log() statements to CloudWatch, and every request results in a 502 error saying, The Lambda function result failed validation: The body is not a string, is not an object, or exceeds the maximum size... For sanity’s sake I’ve reduced the return response to

export const handler = async (event) => {
  console.log('hello');

  const response = {
    statusCode: 200,
    body: JSON.stringify('hello hello'),
  };
  return response;
};

Which results in no output to CloudWatch, and the 502 error before when I hit it from Postman or a browser. What is more puzzling is that when I test the function in the AWS Management Console it functions as expected, where the console.log() statements appear in CloudWatch and the response is returned. Also when I hit the distribution from Postman or the browser for an image that exists, the proper image is returned.

Any ideas what might be causing this?

For context here are my role permissions assigned to the lambda function:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:GetFunction",
                "lambda:InvokeFunction",
                "lambda:EnableReplication*",
                "lambda:DisableReplication*"
            ],
            "Resource": "arn:aws:lambda:*:*:function:*"
        }
    ]
}

Here is my trust policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "lambda.amazonaws.com",
                    "edgelambda.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

and I have verified multiple times that the correct lambda@edge function is attached to the CloudFront Origin Request Trigger

Where the ARN follows the syntax -> arn:aws:lambda:us-east-1:{{TWELVE_DIGIT_NUMERIC_ID}}:function:{{FUNCTION_NAME}}:{{FUNCTION_VERSION}}