Can a CloudFront response event function change query parameters?

Definition: No. A CloudFront response event function can read the request query string, subject to the All setting for Query strings when an origin event needs access, but it cannot create or update that query string. The rule covers viewer-response events and origin-response events. Origin-response events exist only in Lambda@Edge, according to Amazon CloudFront's edge function restrictions.

Key facts

• Amazon CloudFront's edge function restrictions apply to both CloudFront Functions and Lambda@Edge: response events can read a query string, while query string creation or update belongs to viewer-request and origin-request events.
• The CloudFront Functions event structure represents the query string as event.request.querystring and identifies viewer-request and viewer-response event types.
• The Lambda@Edge event structure places the request and query string inside Records.cf.request for viewer and origin response events. For an origin response or origin request function, the cache policy or origin request policy must set Query strings to All.

What does a response event receive?

The event contains a request representation alongside the response representation. Amazon's Lambda@Edge event structure documents response-event data in Records.cf.config, Records.cf.request, and Records.cf.response. The request subobject contains the query string, even when its value is empty. The same page shows separate origin-response and viewer-response event examples.

The relevant part of the documented Lambda@Edge shape is:

"config": {
  "eventType": "origin-response"
},
"request": {
  "querystring": "",
  "uri": "/"
}

CloudFront Functions uses a different object shape. Its event structure says that the request object contains a querystring object with one field for each parameter, and an empty request still contains an empty querystring object. Its context identifies the event as viewer-request or viewer-response. The request object is the place where a viewer-response function can inspect the incoming parameters.

Why is the field read-only in these events?

Amazon CloudFront's edge function restrictions distinguish the event phase. The documentation states that a function can create or update a query string for viewer-request and origin-request events. It then states that a function can read a query string but cannot create or update one for origin-response and viewer-response events.

That restriction applies even though the Lambda@Edge request field is described as read/write in the general request-event field list. The event phase rule controls response events. A response function can work with the response object, such as the response headers or status, while the request query string remains available for inspection.

Where can a function change the query string?

The permitted rewrite phases are viewer-request and origin-request. Origin-request events exist only in Lambda@Edge. Amazon's edge function restrictions assign query string creation or update to those phases. For a CloudFront Function in a request event, the event structure page gives this query string assignment as an example:

var request = event.request;
request.querystring = 'ID=42&Exp=1619740800&TTL=1440&NoValue=&querymv=val1&querymv=val2,val3';

The same restrictions page limits a rewritten URI, including its query string, to fewer than 8,192 characters. It also states that a function can read an origin-response query string only when the cache policy or origin request policy is set to All for Query strings. A response event is therefore the inspection point for the request value, while a request event is the documented phase for changing it.

Related terms

• How are repeated query parameters represented in a CloudFront function event?
• Does changing a URI in CloudFront Functions change the selected origin?
• URL parameters

FAQ

Can a viewer-response CloudFront Function remove a query parameter?

No. It can read the request query string, but Amazon CloudFront's restrictions page permits query string creation and update only in viewer-request and origin-request events.

Can an origin-response function read the query string?

Yes. An origin-response function is a Lambda@Edge function, and its request object includes querystring. The Lambda@Edge event structure shows that request field. The cache policy or origin request policy must set Query strings to All for the function to access it.

Can a response event rewrite the URI instead?

The documented query string restriction still applies to the query portion of the request URI. A response event can inspect the request, while query string changes belong to the request-event phase.

Sources

1. Amazon CloudFront, "Restrictions on all edge functions", undated
2. Amazon CloudFront, "CloudFront Functions event structure", undated
3. Amazon CloudFront, "Lambda@Edge event structure", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer