AWS WAF with AWS Lambda Function URLs?

AWS WAF cannot be configured on Lambda Function URLs.

You can set Lambda Function URLs to CloudFront origin and enable AWS WAF for CloudFront.

Lambda function URLs do not support WAF. If you need WAF, use API Gateway instead of function URLs.

If you use a CloudFront distribution instead, you will need to make sure that the requests are coming from CF. Users may be able to guess the URL and invoke the function directly, bypassing WAF. To prevent that you could add a special header with some secret value in CloudFront and you will need to verify that header in your Lambda functions.

You can use CloudFront + labdaAtedge to fully secure the access using url signing. I wrote a whole article explaining the process here