Lambda function URL CORS does not allow wildcard origins (*)

Check ID: awslambda_function_url_cors_policy
Provider: AWS
Service: awslambda
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsLambdaFunction

What this check verifies

Lambda function URL CORS policy is reviewed for AllowOrigins. The presence of * indicates a wide origin allowance in the CORS configuration.

Risk

Wildcard origins allow any website to call the endpoint from a browser and read responses, weakening origin isolation. This can lead to data exposure (C) and unauthorized actions (I) if state-changing methods are reachable, enabling scripted abuse and cross-origin attacks.

Recommendation

Apply least privilege to CORS:

Restrict AllowOrigins to trusted domains; avoid *
Limit AllowMethods/AllowHeaders; disable AllowCredentials unless required
Prefer authenticated access (e.g., AWS_IAM) and enforce resource policies for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lambda update-function-url-config --function-name <example_resource_name> --cors AllowOrigins=https://www.example.com

# Terraform: restrict Lambda Function URL CORS to a specific origin
resource "aws_lambda_function_url" "example" {
  function_name      = "<example_resource_name>"
  authorization_type = "AWS_IAM"
  cors {
    allow_origins = ["https://www.example.com"] # Critical: removes '*' wildcard by allowing only this origin
  }
}

# CloudFormation: restrict Lambda Function URL CORS to a specific origin
Resources:
  FunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      TargetFunctionArn: <example_resource_arn>
      AuthType: AWS_IAM
      Cors:
        AllowOrigins:
          - https://www.example.com  # Critical: removes '*' wildcard by allowing only this origin

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_url_cors_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function resource-based policy blocks public access Lambda function URL is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires