# Ensure Lambda function URLs use AWS IAM authentication - Source: https://support.icompaas.com/support/solutions/articles/a_1793292233737434-ensure-lambda-function-urls-use-aws-iam-authentication - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every AWS Lambda function URL uses the AWS\_IAM authentication type. With AWS\_IAM, only authenticated IAM users and roles that have permission to invoke the function URL can call it. With the NONE authentication type, anyone on the Internet who knows the URL can invoke the function. **Rationale** An unauthenticated function URL lets anyone run the function's code. Attackers can call it in scripts to read data, trigger unintended changes through the function's own permissions, or send large volumes of requests that cause outages and unexpected costs. Requiring IAM authentication and granting lambda:InvokeFunctionUrl only to the principals that need it applies least privilege to the function. **Impact** - Prevents anonymous invocation of the function over the Internet - Reduces the risk of data exposure, misuse of the function's permissions and request floods - Callers must sign their requests with AWS Signature Version 4 and have permission to invoke the function URL; existing unauthenticated clients, browsers and webhooks will receive 403 Forbidden errors **Default Value** A Lambda function has no function URL unless one is created. When a function URL is created, the authentication type must be chosen explicitly as either AWS\_IAM or NONE. **Pre-Requisites** - IAM permissions: lambda:ListFunctions, lambda:GetFunctionUrlConfig, lambda:UpdateFunctionUrlConfig, lambda:GetPolicy and lambda:AddPermission - A list of the IAM users, roles or accounts that need to call the function URL, and confirmation that their clients can sign requests **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Lambda console and select **Functions**. 3. Select a function and open the **Configuration** tab, then **Function URL**. 4. If a function URL exists, check the value of **Auth type**. 5. Repeat for each function in each region in use. 6. If any function URL has auth type **NONE**, follow the implementation steps. **CLI:** List the functions in a region: aws lambda list-functions --region --query "Functions\[\].FunctionName" Show the authentication type of a function URL: aws lambda get-function-url-config --function-name --region --query "\[FunctionUrl,AuthType\]" A function fails if it has a function URL and AuthType is not AWS\_IAM. Functions without a function URL (the command returns ResourceNotFoundException) are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Lambda console and select **Functions**. 3. Select the function and open **Configuration**, then **Function URL**. 4. Choose **Edit**. 5. Set **Auth type** to **AWS\_IAM**. 6. Choose **Save**. 7. Grant lambda:InvokeFunctionUrl only to the principals that need to call the function, through their IAM policies or the function's resource-based policy. 8. Repeat for each affected function in each region in use. **CLI:** Require IAM authentication on the function URL: aws lambda update-function-url-config --function-name --region --auth-type AWS\_IAM If a principal from another account must call the function URL, allow it in the function's resource-based policy: aws lambda add-permission --function-name --region --statement-id --action lambda:InvokeFunctionUrl --principal --function-url-auth-type AWS\_IAM **Backout Plan** Before making changes, save the current function URL configuration and resource-based policy: aws lambda get-function-url-config --function-name --region > function-url-config-backup.json aws lambda get-policy --function-name --region > function-policy-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Lambda console, select the function and open **Configuration**, then **Function URL**. 3. Choose **Edit** and set **Auth type** back to **NONE**. 4. Choose **Save**. **CLI:** aws lambda update-function-url-config --function-name --region --auth-type NONE Note: rolling back makes the function URL publicly invocable again. Use it only as a temporary measure while clients are updated to sign their requests. **Reference** - [https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) - [https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html](https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html) - [https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-url-config.html](https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-url-config.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.