Lambda Function URL Invoke with ALB

To invoke a Lambda Function URL with the auth type AWS_IAM using an Application Load Balancer (ALB), you'll need to grant the necessary permissions to the ALB. Here's how you can do it:

1. First, ensure that your Lambda function's URL is configured with the AWS_IAM auth type.

2. You'll need to add a resource-based policy to your Lambda function to allow the ALB to invoke the function URL. You can do this using the AWS CLI with the following command:

   aws lambda add-permission
   --function-name your-function-name
   --action lambda:InvokeFunctionUrl
   --statement-id alb-invoke
   --principal elasticloadbalancing.amazonaws.com
   --function-url-auth-type AWS_IAM

   Replace 'your-function-name' with the actual name of your Lambda function.

3. Next, you need to configure the ALB to sign requests to the Lambda function URL. This is because the AWS_IAM auth type requires signed requests. However, it's important to note that currently, ALBs do not have built-in capability to sign requests for Lambda function URLs with AWS_IAM auth type.

4. Given this limitation, you might need to consider alternative approaches:

   a. Use a Lambda function as a target for your ALB instead of using a function URL. In this case, you would create a target group for the Lambda function and add a rule to the load balancer that sends requests to this target group.

   b. If you must use the function URL, you might need to introduce an intermediary service (like another Lambda function or an EC2 instance) that can handle the signing of requests before forwarding them to the function URL.

5. If you decide to use a Lambda function as a target for your ALB, you'll need to grant permission to the ALB to invoke the Lambda function directly. You can do this with the following AWS CLI command:

   aws lambda add-permission
   --function-name your-function-name
   --statement-id alb-statement
   --action lambda:InvokeFunction
   --principal elasticloadbalancing.amazonaws.com

Remember to replace 'your-function-name' with your actual function name.

These steps should help you set up the necessary permissions for your ALB to interact with your Lambda function, whether through a function URL or direct invocation. However, keep in mind the current limitations with ALBs and Lambda function URLs using AWS_IAM authentication.
Sources
Use Lambda functions as targets of an Application Load Balancer - Elastic Load Balancing
Process Application Load Balancer requests with Lambda - AWS Lambda
Control access to Lambda function URLs - AWS Lambda
Community | Enhancing security for Lambda function URLs

To clarify, ALBs cannot currently invoke Lambda Function URLs secured with AWS_IAM auth because they do not support signing requests using Signature Version 4, which is required by IAM-authenticated Function URLs.

Why it works with NONE auth When your Lambda Function URL is set to NONE, any public client (including ALB) can invoke it—no signature is required. But once you switch to AWS_IAM, the caller must sign the HTTP request using AWS SigV4, which ALB cannot do.

So what's the problem? Even if you try adding this permission:

bash Copy Edit aws lambda add-permission
--function-name your-function-name
--action lambda:InvokeFunctionUrl
--statement-id alb-invoke
--principal elasticloadbalancing.amazonaws.com
--function-url-auth-type AWS_IAM …it won’t help—because the ALB still can't sign the request to pass IAM auth checks.

Recommended Alternative If your goal is to route traffic through ALB to your Lambda securely:

Option 1: Use Lambda as a direct ALB Target Instead of using the Function URL, configure your Lambda directly as a target group in the ALB.

This approach allows ALB to invoke your Lambda without needing Function URLs or request signing.

Add this permission:

bash Copy Edit aws lambda add-permission
--function-name your-function-name
--statement-id alb-target
--action lambda:InvokeFunction
--principal elasticloadbalancing.amazonaws.com
--source-arn arn:aws:elasticloadbalancing:{region}:{account}:loadbalancer/app/{alb-name}/{id} Option 2: Use API Gateway instead of ALB API Gateway does support IAM-based authorization and can sign requests properly.

You can expose the Lambda via API Gateway and secure it using IAM or other auth methods.

Summary ALB cannot invoke Lambda Function URLs with AWS_IAM auth — no SigV4 signing support.

Use direct Lambda targets in ALB or use API Gateway if you need IAM-based security.

Avoid Function URLs for IAM use cases with ALB.

Let me know if you’d like an example Terraform or CloudFormation config to help with Option 1.