Back to Checks
aws

Lambda function URL CORS does not allow wildcard origins (*)

awslambda_function_url_cors_policy
Service: awslambdaSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsLambdaFunction

Lambda function URL CORS policy is reviewed for AllowOrigins. The presence of * indicates a wide origin allowance in the CORS configuration.

Prowler logoProwlerprowler-provider-aws

Risk

Wildcard origins allow any website to call the endpoint from a browser and read responses, weakening origin isolation.

This can lead to data exposure (C) and unauthorized actions (I) if state-changing methods are reachable, enabling scripted abuse and cross-origin attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks awslambda_function_url_cors_policy

Recommendation

Apply least privilege to CORS:

  • Restrict AllowOrigins to trusted domains; avoid *
  • Limit AllowMethods/AllowHeaders; disable AllowCredentials unless required
  • Prefer authenticated access (e.g., AWS_IAM) and enforce resource policies for defense in depth

Remediation

CLI

aws lambda update-function-url-config --function-name <example_resource_name> --cors AllowOrigins=https://www.example.com

Terraform

# Terraform: restrict Lambda Function URL CORS to a specific origin
resource "aws_lambda_function_url" "example" {
  function_name      = "<example_resource_name>"
  authorization_type = "AWS_IAM"
  cors {
    allow_origins = ["https://www.example.com"] # Critical: removes '*' wildcard by allowing only this origin
  }
}

NativeIaC

# CloudFormation: restrict Lambda Function URL CORS to a specific origin
Resources:
  FunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      TargetFunctionArn: <example_resource_arn>
      AuthType: AWS_IAM
      Cors:
        AllowOrigins:
          - https://www.example.com  # Critical: removes '*' wildcard by allowing only this origin

Other

1In the AWS Console, go to Lambda > Functions and select <example_resource_name>
2Open Configuration > Function URL > Edit
3In CORS, remove '*' from Allowed origins and enter https://www.example.com
4Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client


class awslambda_function_url_cors_policy(Check):
    def execute(self):
        findings = []
        for function in awslambda_client.functions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=function)

            if function.url_config:
                if "*" in function.url_config.cors_config.allow_origins:
                    report.status = "FAIL"
                    report.status_extended = f"Lambda function {function.name} URL has a wide CORS configuration."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Lambda function {function.name} does not have a wide CORS configuration."

                findings.append(report)

        return findings

References