On a recent project, we needed to add a new AWS Lambda that would touch an already existing relational database service (RDS) instance. Here's our solution.
There's no pre-built security group to allow inbound traffic from CloudFront, so I made an AWS Lambda function to periodically update our security group.