Back to Checks
aws

Lambda function URL is not publicly accessible

awslambda_function_url_public
Service: awslambdaSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsLambdaFunction

AWS Lambda function URLs are assessed to determine whether AuthType enforces AWS IAM authentication or permits public invocation.

Applies to functions with a function URL and highlights when requests must be authenticated and authorized via IAM principals.

Prowler logoProwlerprowler-provider-aws

Risk

An unauthenticated function URL lets anyone invoke code:

  • Confidentiality: data exposure
  • Integrity: unintended changes via over-privileged logic
  • Availability: DoS/denial-of-wallet through high request rates

Attackers can script calls, exfiltrate data, and pivot using the function's permissions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks awslambda_function_url_public

Recommendation

Enforce AWS_IAM on function URLs and apply least privilege:

  • Grant lambda:InvokeFunctionUrl only to required principals
  • Avoid * principals or broad conditions
  • Limit CORS to trusted origins and methods
  • Set reserved concurrency to contain abuse

Consider defense in depth (WAF/CDN or private access) for Internet use.

Remediation

CLI

aws lambda update-function-url-config --function-name <FUNCTION_NAME> --auth-type AWS_IAM

Terraform

# Set Lambda Function URL to require IAM authentication
resource "aws_lambda_function_url" "example" {
  function_name      = "<example_resource_name>"
  authorization_type = "AWS_IAM"  # CRITICAL: blocks public access by requiring IAM auth
}

NativeIaC

# CloudFormation: set Lambda Function URL to require IAM auth
Resources:
  FunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      TargetFunctionArn: arn:aws:lambda:<region>:<account-id>:function/<example_resource_name>
      AuthType: AWS_IAM  # CRITICAL: requires IAM authentication, preventing public access

Other

1In AWS Console, go to Lambda > Functions and open <example_resource_name>
2Select Configuration > Function URL > Edit
3Set Auth type to AWS_IAM
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client
from prowler.providers.aws.services.awslambda.awslambda_service import AuthType


class awslambda_function_url_public(Check):
    def execute(self):
        findings = []
        for function in awslambda_client.functions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=function)

            if function.url_config:
                if function.url_config.auth_type == AuthType.AWS_IAM:
                    report.status = "PASS"
                    report.status_extended = f"Lambda function {function.name} does not have a publicly accessible function URL."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Lambda function {function.name} has a publicly accessible function URL."

                findings.append(report)

        return findings

References