I am looking to implement a Lambda@Edge function that will add CSP headers to my website and thus will improve my site's security.
I do have an issue with the URL report settings (report-to/report-uri). As far as I can tell, there's no way for me to authenticate CSP violation requests. Does that mean that if a malicious person gains a hold of my reporting API, they can just spam POST requests and send false data? Is there any way to add any sort of security for the reports that get posted via the reporting directive?
Yes, a malicious person can sent a fake SPAM violation reports. But he will not gain any profit from that, just DOS-attack which will not affect the website.
You can make some protection from this if you do use your own service for obtaining reports of violations. You can check cookies, generate a special URL for the reporting API for each visitor (for example, add md5 (IP-address) to it), etc.
But there is usually no reason to protect reports. An attacker cannot determine if this API is currently running or disabled. Therefore, a blind attack of reporting API does not make sense.