How do I restrict public access to Lambda function URLs?

Resolution

Set the function URL AuthType to AWS_IAM of an existing function URL

If you set the function URL AuthType to AWS_IAM, then Lambda uses AWS Identity and Access Management (IAM) to authenticate and authorize each request. Callers must sign requests with AWS Signature Version 4 (SigV4). Callers must also have the lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions. Lambda rejects unauthenticated requests. For more information, see Control access to Lambda function URLs.

To set the function URL Auth type to AWS_IAM of an existing function URL, use the Lambda console or AWS Command Line Interface (AWS CLI).

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To use the Lambda console, complete the following steps:

1. Open the Lambda console.
2. In the navigation pane, choose the Functions.
3. Select the name of the function that you want to update.
4. Choose the Configuration tab, and then choose Function URL.
5. Choose Edit.
6. For Auth type, choose AWS_IAM.
7. Choose Save.

To use the AWS CLI, run the update-function-url-config command:

aws lambda update-function-url-config \
    --function-name my-function \
    --auth-type AWS_IAM

Note: Replace my-function with your function.

Grant invoke permissions to a specific principal

With the URL AuthType set to AWS_IAM, callers in the same account receive access through their identity-based policy. For cross-account access, you must grant access in both the caller's identity-based policy and the function's resource-based policy.

The following resource-based policy allows only the IAM role in account 444455556666 to invoke the function URL:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::444455556666:role/example"
      },
      "Action": "lambda:InvokeFunctionUrl",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function",
      "Condition": {
        "StringEquals": {
          "lambda:FunctionUrlAuthType": "AWS_IAM"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::444455556666:role/example"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function",
      "Condition": {
        "Bool": {
          "lambda:InvokedViaFunctionUrl": "true"
        }
      }
    }
  ]
}

Note: Replace 444455556666 with the IAM role account ID, us-east-1 with your AWS Region, 123456789012 with your AWS account ID, and my-function with your function.

Use a public URL with CloudFront and OAC

To use a public URL with CloudFront and OAC, complete the following steps:

1. Create a CloudFront distribution that uses your Lambda function URL as the origin.
2. Set the function URL auth type to AWS_IAM.
3. Grant CloudFront permissions to access the Lambda function URL.
4. Create a new origin access control (OAC).
   Note: Set the Origin Type to Lambda.
5. Attach the OAC to the function URL origin in your link distribution.

For more information, see Restrict access to an AWS Lambda function URL origin.

Enforce the AWS_IAM auth type across your organization

To block the creation or update of function URLs that use the AuthType set to NONE, use the lambda:FunctionUrlAuthType condition key in an IAM policy or service control policy (SCP).

To restrict access to create or update a function URL for AuthType that's not set to AWS_IAM, use the following function URL SCP with explicit deny:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "lambda:CreateFunctionUrlConfig",
                "lambda:UpdateFunctionUrlConfig"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "lambda:FunctionUrlAuthType": "AWS_IAM"
                }
            }
        }
    ]
}

Confirm the function URL configuration and use IAM Access Analyzer

To make sure that you correctly configured your function URL and check your Lambda functions, complete the following steps:

1. To confirm that the AuthType is set to AWS_IAM in the function URL configuration, run the get-function-url-config command:

    aws lambda get-function-url-config --function-name my-function

   Note: Replace my-function with your function name.

2. To confirm that the function URL resource-based policy doesn't grant access to the anonymous principal, run the get-policy command:

    aws lambda get-policy --function-name my-function

   Note: Replace my-function with your function name.

3. Use the IAM Access Analyzer to identify Lambda functions that grant public or cross-account access.
   Note: If you need to activate AWS Identity and Access Management Access Analyzer, then see Getting started with AWS Identity and Access Management Access Analyzer.

To troubleshoot IAM Access Analyzer permissions, see How do I resolve permission issues with policies generated from IAM Access Analyzer?

Note: AWS charges you for any unused access analysis that you create per month. For more information, see Pricing for IAM Access Analyzer.

Related information

Protecting an AWS Lambda function URL with Amazon CloudFront and Lambda@Edge