Why cloudfront authorize GET method even we enable AWS_IAM for lambda URL

Hello,

CloudFront authorizes GET requests by default for performance reasons., It's designed to handle HTTP requests efficiently, and GET is one of the most common methods used to retrieve data.

AWS_IAM is for security. It verifies if a request is authorized before sending it to your Lambda function.

Both work together: CloudFront handles the request, and AWS_IAM checks if it's allowed.

WHY:

Because CloudFront's cache behavior is typically configured to allow public access to GET requests. To enforce AWS_IAM authorization, you need to ensure that the CloudFront behavior is set up to require signed URLs or restrict access via an origin request policy that includes proper authorization headers. Without these additional configurations, CloudFront will continue to authorize GET requests as it does by default.