AWS Lambda@Edge function to add common security headers for static content served via CloudFront.

Create a new IAM role with the name aws-lambda-edge-execution-role and the following trust relationship:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "lambda.amazonaws.com",
          "edgelambda.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Add the function code to AWS Lambda in the US East (N. Virginia) region with the following configuration options:

Next publish a version of the function and copy its Lambda Function ARN.

In the behavior settings of the CloudFront distribution, add a new Lambda Function Association with the Event Type Origin Response and the Lambda Function ARN copied from the function configuration.
Save your edits and wait until the new settings have been deployed.

Released under the MIT license.

Sebastian Tschan