Description

Ensure that Lambda function URLs do not have AuthType set to NONE with a resource-based policy that allows the wildcard principal (*), which permits any unauthenticated caller on the internet to invoke the function directly.

Rationale

When a function URL's AuthType is NONE and a resource policy grants invoke permission to Principal '*' (the FunctionURLAllowPublicAccess statement typically added when NONE is selected via the console), any unauthenticated party who discovers the URL can invoke the function, potentially triggering unintended business logic, consuming compute resources, driving up cost, or accessing data returned by the function. Unless a function URL is genuinely intended to serve as a public, unauthenticated endpoint, invocation should require AWS_IAM authentication or be restricted to specific principals.

Impact

  • Prevents unauthenticated internet callers from invoking sensitive or internal functions via their URL

  • Reduces the risk of resource abuse, unexpected billing, or unintended business logic execution

  • Requires clients to be updated with proper IAM credentials if switching a previously public URL to AWS_IAM auth

Default Value

Function URLs are not created by default; when created via the console with Auth type NONE, a public-access resource policy is automatically added unless explicitly restricted.

Pre-Requisites

  • IAM permissions to view and update the function URL configuration and resource policy (lambda:GetFunctionUrlConfig, lambda:UpdateFunctionUrlConfig, lambda:RemovePermission, lambda:AddPermission)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Lambda and select the function to review.

  3. Open the Configuration tab, then Function URL.

  4. Review the Auth type field.

  5. If Auth type is NONE, open the Permissions tab and review the resource-based policy for a statement granting lambda:InvokeFunctionUrl to Principal '*'.

  6. If such a statement exists on a function that should not be public, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Lambda and select the function to update.

  3. Open the Configuration tab, then Function URL, and select Edit.

  4. Change Auth type from NONE to AWS_IAM.

  5. Save the changes.

  6. Navigate to the Permissions tab and remove any remaining resource-based policy statement (such as FunctionURLAllowPublicAccess) granting access to Principal '*', since it is not automatically removed when the auth type changes.

  7. Grant invoke permission (lambda:InvokeFunctionUrl) only to the specific IAM roles or users that legitimately need to call the function, and update client applications to sign requests using SigV4.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Lambda and select the affected function.

  3. Open the Configuration tab, then Function URL, and select Edit.

  4. Change Auth type from AWS_IAM back to NONE.

  5. Save the changes, then add a resource-based policy statement granting lambda:InvokeFunctionUrl to Principal '*' if public access should be restored.

Reference