Control access to Lambda function URLs

You can control access to your Lambda function URLs using the AuthType parameter combined with resource-based policies attached to your specific function. The configuration of these two components determines who can invoke or perform other administrative actions on your function URL.

The AuthType parameter determines how Lambda authenticates or authorizes requests to your function URL. When you configure your function URL, you must specify one of the following AuthType options:

For additional insights into security, you can use AWS Identity and Access Management Access Analyzer to get a comprehensive analysis of external access to your function URL. IAM Access Analyzer also monitors for new or updated permissions on your Lambda functions to help you identify permissions that grant public and cross-account access. You can use IAM Access Analyzer at no charge. To get started with IAM Access Analyzer, see Using AWS IAM Access Analyzer.

This page contains examples of resource-based policies for both auth types, and how to create these policies using the AddPermission API operation or the Lambda console. For information about how to invoke your function URL after you've set up permissions, see Invoking Lambda function URLs.

Using the AWS_IAM auth type

If you choose the AWS_IAM auth type, users who need to invoke your Lambda function URL must have the lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions. Depending on who makes the invocation request, you might have to grant this permission using a resource-based policy.

If the principal making the request is in the same AWS account as the function URL, then the principal must either have lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions in their identity-based policy, or have permissions granted to them in the function's resource-based policy. In other words, a resource-based policy is optional if the user already has lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions in their identity-based policy. Policy evaluation follows the rules outlined in Policy evaluation logic.

If the principal making the request is in a different account, then the principal must have both an identity-based policy that gives them lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions and permissions granted to them in a resource-based policy on the function that they are trying to invoke. Policy evaluation follows the rules outlined in Determining whether a cross-account request is allowed.

The following resource-based policy allows the example role in AWS account 444455556666 to invoke the function URL associated with function my-function. The lambda:InvokedViaFunctionUrl context key restricts the lambda:InvokeFunction action to function URL calls. This means that the principal must use the function URL to invoke the function. If you don't include lambda:InvokedViaFunctionUrl, the principal can invoke your function through other invocation methods, in addition to the function URL.

You can create this resource-based policy through the console using the following steps:

Alternatively, you can create this policy using the following add-permission AWS Command Line Interface (AWS CLI) commands. When you use the AWS CLI, you must add the lambda:InvokeFunctionUrl and lambda:InvokeFunction statements separately. For example:

aws lambda add-permission --function-name my-function \
  --statement-id UrlPolicyInvokeURL \
  --action lambda:InvokeFunctionUrl \
  --principal 444455556666 \
  --function-url-auth-type AWS_IAM

aws lambda add-permission --function-name my-function \
  --statement-id UrlPolicyInvokeFunction \
  --action lambda:InvokeFunction \
  --principal 444455556666 \
  --invoked-via-function-url

Using the NONE auth type

In some cases, you might want your function URL to be public. For example, you might want to serve requests made directly from a web browser. To allow public access to your function URL, choose the NONE auth type.

If you choose the NONE auth type, Lambda doesn't use IAM to authenticate requests to your function URL. However, your function must have a resource-based policy that allows lambda:InvokeFunctionUrl and lambda:InvokeFunction. When you create a function URL with auth type NONE using the console or AWS Serverless Application Model (AWS SAM), Lambda automatically creates the resource-based policy for you. If you're using the AWS CLI, AWS CloudFormation, or the Lambda API directly, you must add the policy yourself.

We recommend that you include the lambda:InvokedViaFunctionUrl context key in your resource-based policies when using the NONE auth type. This context key ensures that the function can only be invoked through the function URL and not through other invocation methods.

Note the following about this policy:

Create the resource-based policy using the AWS CLI

Unless you use the console or AWS SAM to create a function URL with auth type NONE, you must add the resource-based policy yourself. Use the following commands to create statements for the lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions. Each statement must be added in a separate command.

aws lambda add-permission \
  --function-name UrlTestFunction \
  --statement-id UrlPolicyInvokeURL \
  --action lambda:InvokeFunctionUrl \
  --principal * \
  --function-url-auth-type NONE

aws lambda add-permission \
  --function-name UrlTestFunction \
  --statement-id UrlPolicyInvokeFunction \
  --action lambda:InvokeFunction \
  --principal * \
  --invoked-via-function-url

If a function's resource-based policy doesn't grant lambda:invokeFunctionUrl and lambda:InvokeFunction permissions, users will get a 403 Forbidden error code when they try to invoke your function URL. This will occur even if the function URL uses the NONE auth type.

Governance and access control

In addition to function URL invocation permissions, you can also control access on actions used to configure function URLs. Lambda supports the following IAM policy actions for function URLs:

To allow or deny function URL access to other AWS entities, include these actions in IAM policies. For example, the following policy grants the example role in AWS account 444455556666 permissions to update the function URL for function my-function in account 123456789012.

Condition keys

For fine-grained access control over your function URLs, use condition context keys. Lambda supports the following context keys for function URLs:

You can use these context keys in policies associated with your function. For example, you might want to restrict who can make configuration changes to your function URLs. To deny all UpdateFunctionUrlConfig requests to any function with URL auth type NONE, you can define the following policy:

To grant the example role in AWS account 444455556666 permissions to make CreateFunctionUrlConfig and UpdateFunctionUrlConfig requests on functions with URL auth type AWS_IAM, you can define the following policy:

You can also use this condition key in a service control policy (SCP). Use SCPs to manage permissions across an entire organization in AWS Organizations. For example, to deny users from creating or updating function URLs that use anything other than the AWS_IAM auth type, use the following service control policy: