Lambda function URL is publicly invocable without authentication

Severity: High
Service: Lambda
Check ID: LAMBDA_FUNCTION_URL_PUBLIC

What this check finds

The function has a Function URL configured with AuthType=NONE, so anyone on the internet can invoke it directly with no IAM or authentication check. This exposes the function's logic, any downstream resources it touches, and its execution-role permissions to unauthenticated callers.

Passing looks like: Lambda function URL requires authentication.

How to fix it

Set the function URL auth type to AWS_IAM, or remove the function URL and front the function with API Gateway/an ALB that enforces authentication.

AWS CLI

aws lambda update-function-url-config --function-name FUNCTION_NAME --auth-type AWS_IAM

Or remove the URL:

aws lambda delete-function-url-config --function-name FUNCTION_NAME

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Lambda function URL is publicly invocable without authentication
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Lambda checks

All Lambda checks