Lambda function URL is not publicly accessible

Check ID: awslambda_function_url_public
Provider: AWS
Service: awslambda
Severity: HIGH
Categories: internet-exposed
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda function URLs are assessed to determine whether AuthType enforces AWS IAM authentication or permits public invocation. Applies to functions with a function URL and highlights when requests must be authenticated and authorized via IAM principals.

Risk

An unauthenticated function URL lets anyone invoke code:

Confidentiality: data exposure
Integrity: unintended changes via over-privileged logic
Availability: DoS/denial-of-wallet through high request rates

Attackers can script calls, exfiltrate data, and pivot using the function’s permissions.

Recommendation

Enforce AWS_IAM on function URLs and apply least privilege:

Grant lambda:InvokeFunctionUrl only to required principals
Avoid * principals or broad conditions
Limit CORS to trusted origins and methods
Set reserved concurrency to contain abuse

Consider defense in depth (WAF/CDN or private access) for Internet use.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lambda update-function-url-config —function-name <FUNCTION_NAME> —auth-type AWS_IAM

# Set Lambda Function URL to require IAM authentication
resource "aws_lambda_function_url" "example" {
  function_name      = "<example_resource_name>"
  authorization_type = "AWS_IAM"  # CRITICAL: blocks public access by requiring IAM auth
}

# CloudFormation: set Lambda Function URL to require IAM auth
Resources:
  FunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      TargetFunctionArn: arn:aws:lambda:<region>:<account-id>:function/<example_resource_name>
      AuthType: AWS_IAM  # CRITICAL: requires IAM authentication, preventing public access

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_url_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function URL CORS does not allow wildcard origins (*)Lambda function does not use cross-account layers

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires