Description

Ensure that every AWS Lambda function URL uses the AWS_IAM authentication type. With AWS_IAM, only authenticated IAM users and roles that have permission to invoke the function URL can call it. With the NONE authentication type, anyone on the Internet who knows the URL can invoke the function.

Rationale

An unauthenticated function URL lets anyone run the function's code. Attackers can call it in scripts to read data, trigger unintended changes through the function's own permissions, or send large volumes of requests that cause outages and unexpected costs. Requiring IAM authentication and granting lambda:InvokeFunctionUrl only to the principals that need it applies least privilege to the function.

Impact

  • Prevents anonymous invocation of the function over the Internet

  • Reduces the risk of data exposure, misuse of the function's permissions and request floods

  • Callers must sign their requests with AWS Signature Version 4 and have permission to invoke the function URL; existing unauthenticated clients, browsers and webhooks will receive 403 Forbidden errors

Default Value

A Lambda function has no function URL unless one is created. When a function URL is created, the authentication type must be chosen explicitly as either AWS_IAM or NONE.

Pre-Requisites

  • IAM permissions: lambda:ListFunctions, lambda:GetFunctionUrlConfig, lambda:UpdateFunctionUrlConfig, lambda:GetPolicy and lambda:AddPermission

  • A list of the IAM users, roles or accounts that need to call the function URL, and confirmation that their clients can sign requests

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select Functions.

  3. Select a function and open the Configuration tab, then Function URL.

  4. If a function URL exists, check the value of Auth type.

  5. Repeat for each function in each region in use.

  6. If any function URL has auth type NONE, follow the implementation steps.

CLI:

List the functions in a region:

aws lambda list-functions --region <REGION> --query "Functions[].FunctionName"

Show the authentication type of a function URL:

aws lambda get-function-url-config --function-name <FUNCTION_NAME> --region <REGION> --query "[FunctionUrl,AuthType]"

A function fails if it has a function URL and AuthType is not AWS_IAM. Functions without a function URL (the command returns ResourceNotFoundException) are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select Functions.

  3. Select the function and open Configuration, then Function URL.

  4. Choose Edit.

  5. Set Auth type to AWS_IAM.

  6. Choose Save.

  7. Grant lambda:InvokeFunctionUrl only to the principals that need to call the function, through their IAM policies or the function's resource-based policy.

  8. Repeat for each affected function in each region in use.

CLI:

Require IAM authentication on the function URL:

aws lambda update-function-url-config --function-name <FUNCTION_NAME> --region <REGION> --auth-type AWS_IAM

If a principal from another account must call the function URL, allow it in the function's resource-based policy:

aws lambda add-permission --function-name <FUNCTION_NAME> --region <REGION> --statement-id <STATEMENT_ID> --action lambda:InvokeFunctionUrl --principal <ACCOUNT_ID> --function-url-auth-type AWS_IAM

Backout Plan

Before making changes, save the current function URL configuration and resource-based policy:

aws lambda get-function-url-config --function-name <FUNCTION_NAME> --region <REGION> > function-url-config-backup.json
aws lambda get-policy --function-name <FUNCTION_NAME> --region <REGION> > function-policy-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console, select the function and open Configuration, then Function URL.

  3. Choose Edit and set Auth type back to NONE.

  4. Choose Save.

CLI:

aws lambda update-function-url-config --function-name <FUNCTION_NAME> --region <REGION> --auth-type NONE

Note: rolling back makes the function URL publicly invocable again. Use it only as a temporary measure while clients are updated to sign their requests.

Reference