I'm currently building an API with Django and AWS Lambda, using Zappa.
At some point in the future my API will be delivering some sensitive information, so I'm investigating SSL key pinning (HPKP). I've run into some road blocks in figuring out exactly how to implement this with AWS on Lambda.
All the guides on HPKP I've encountered have assumed that I'm operating an HTTP server where I can configure response headers. This isn't the case with AWS Lambda, but I assume the equivalent is either CloudFront or API Gateway.
This Amazon help document gives me the following advice:
To use certificate pinning with ACM Certificates, you can do the following:
- Import your own certificate into ACM and then pin your application to the imported certificate. ACM doesn't provide managed renewal for imported certificates.
- Pin your application to the Amazon root certificates.
But offers no guidance on exactly how to:
- "pin your application to the imported certificate."
- "Pin your application to the Amazon root certificates."
Is the documentation suggesting my Django application itself should return responses with the HPKP headers? Or is there a better way of achieving this through CloudFront/API Gateway?