index.js

'use strict';

exports.handler = (event, context, callback) => {
  const response = event.Records[0].cf.response;
  const headers = response.headers;

  headers['strict-transport-security'] = [{
    key: 'Strict-Transport-Security',
    value: 'max-age=31536000'
  }];

  headers['x-frame-options'] = [{
    key: 'X-Frame-Options',
    value: 'DENY'
  }];

  headers['x-xss-protection'] = [{
    key: 'X-XSS-Protection',
    value: '1; report-uri=https://foobar.report-uri.com/r/d/xss/enforce'
  }];

  headers['x-content-type-options'] = [{
    key: 'X-Content-Type-Options',
    value: 'nosniff'
  }];

  headers['referrer-policy'] = [{
    key: 'Referrer-Policy',
    value: 'strict-origin'
  }];

  headers['expect-ct'] = [{
    key: 'Expect-CT',
    value: 'max-age=3600; report-uri=https://foobar.report-uri.com/r/d/ct/reportOnly'
  }];

  callback(null, response);
};