Comment by joe_hoyle

Is it not possible to set the lambda url has an origin in CloudFront and get WAF protection that way?

For all production workloads we typically have cloudfront in front of everything.