Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

Lambda Function URL without direct-origin IAM authentication

AWS_OPS_010 HIGH Security

What it checks

Lambda Function URL without direct-origin IAM authentication

Where it applies

Terraform: aws_lambda_function_url

CloudFormation: AWS::Lambda::Url

How to fix it

  1. Quickest fix: change authorization_type to AWS_IAM. The URL stays the same; callers need SigV4 signing.
  2. For public viewers, manually configure a CloudFront distribution with the Lambda Function URL as its origin, a signing origin access control (OAC), and a CLOUDFRONT WAF web ACL attached through the distribution web_acl_id. Keep authorization_type = AWS_IAM. Grant CloudFront lambda:InvokeFunctionUrl and lambda:InvokeFunction only for that distribution SourceArn, and remove public direct-origin permissions. An unattached REGIONAL ACL or a WebACLAssociation on another resource does not protect the URL.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules