Description
Ensure that the cross-origin resource sharing (CORS) configuration of every AWS Lambda function URL does not include the wildcard * in its allowed origins. Allowed origins should list only the specific trusted websites that need to call the function from a browser.
Rationale
A wildcard origin lets any website call the function URL from a visitor's browser and read the response. This weakens browser origin isolation and can expose data to malicious sites, or let them trigger state-changing actions if the function accepts them. Restricting allowed origins to trusted domains, and keeping allowed methods and headers to the minimum needed, applies least privilege to browser access.
Impact
Prevents untrusted websites from reading responses from the function URL in a browser
Reduces the risk of cross-origin abuse of the function
Browser-based clients served from origins not in the allowed list will receive CORS errors
Non-browser clients (for example, server-side scripts) are not affected by CORS settings
Default Value
A function URL has no CORS configuration unless one is added. The console offers a CORS option when the URL is created or edited, and any allowed origins, including *, must be set explicitly.
Pre-Requisites
IAM permissions: lambda:ListFunctions, lambda:GetFunctionUrlConfig and lambda:UpdateFunctionUrlConfig
A list of the exact origins (scheme and domain, for example https://www.example.com) that legitimately call the function from a browser
Remediation
Test Plan
Console:
Sign in to the AWS Management Console at https://console.aws.amazon.com.
Open the AWS Lambda console and select Functions.
Select a function and open the Configuration tab, then Function URL.
If a function URL exists, check the Allow origin value in the CORS settings.
Repeat for each function in each region in use.
If any function URL allows the origin *, follow the implementation steps.
CLI:
List the functions in a region:
aws lambda list-functions --region <REGION> --query "Functions[].FunctionName"
Show the authentication type and CORS allowed origins of a function URL:
aws lambda get-function-url-config --function-name <FUNCTION_NAME> --region <REGION> --query "[FunctionUrl,AuthType,Cors.AllowOrigins]"
A function fails if it has a function URL and AllowOrigins contains *. Functions without a function URL (the command returns ResourceNotFoundException) are not evaluated.
Implementation Steps
Console:
Sign in to the AWS Management Console at https://console.aws.amazon.com.
Open the AWS Lambda console and select Functions.
Select the function and open Configuration, then Function URL.
Choose Edit.
In the CORS settings, remove * from Allow origin and enter each trusted origin, for example https://www.example.com.
Choose Save.
Repeat for each affected function in each region in use.
CLI:
Restrict the allowed origins to a trusted origin:
aws lambda update-function-url-config --function-name <FUNCTION_NAME> --region <REGION> --cors AllowOrigins=<TRUSTED_ORIGIN>
The --cors option replaces the whole CORS configuration, so include any other CORS settings that must be kept (for example AllowMethods, AllowHeaders and AllowCredentials) from the Test Plan output:
aws lambda update-function-url-config --function-name <FUNCTION_NAME> --region <REGION> --cors "AllowOrigins=<TRUSTED_ORIGIN>,AllowMethods=GET,POST,AllowHeaders=content-type"
Backout Plan
Before making changes, save the current function URL configuration:
aws lambda get-function-url-config --function-name <FUNCTION_NAME> --region <REGION> > function-url-config-backup.json
To roll back:
Sign in to the AWS Management Console at https://console.aws.amazon.com.
Open the AWS Lambda console, select the function and open Configuration, then Function URL.
Choose Edit and set the CORS settings back to the values in the saved backup.
Choose Save.
Note: rolling back allows any website to call the function URL from a browser again. Use it only as a temporary measure.
Reference