We're doing the same! The Lambda function also has an authentication layer, so we can protect user-uploaded assets.

Interesting! Can you tell me more how you use CloudFront (cache) behaviours with sharp?

Lots of ways to do this but generally you attach a Lambda function to an origin response. If the path meets specific conditions (is 404/403, contains specific query string param) then run the Lambda function.

So imagine if you have:

original.jpg

Then just return it from the origin.

But imagine if you have original.jpg?size=150

Run the Lambda function (in this case a Sharp resize function) on the original.jpg file and return it. It'll get cached so the next time someone calls original.jpg?size=150 it just return the 150px width image without running any function as there was never a need to hit the origin.