A Lambda function URL with auth type NONE performs no authentication: anyone who has the URL can invoke the function, provided the resource policy grants public access. Auth type AWS_IAM requires a signed request from an IAM principal that has permission. Choose NONE only for endpoints that are meant to be public.
The two settings work together
Access to a function URL depends on two things: the AuthType parameter and the function's resource-based policy. AuthType decides how Lambda authenticates the request. The resource policy always applies on top.
With AWS_IAM, Lambda uses IAM to authenticate and authorize requests using the caller's identity policy and the function's resource policy. With NONE, Lambda does no authentication, but the resource policy must still grant public access before the URL accepts requests. If the policy is missing, callers get a 403 Forbidden even with auth type NONE.
What the permissions look like
For AWS_IAM, callers need lambda:InvokeFunctionUrl and lambda:InvokeFunction. AWS notes that starting in October 2025, new function URLs require both permissions. Within one account, the caller needs them in an identity policy or the resource policy. Across accounts, the caller needs both an identity policy and a resource policy grant.
The console and AWS SAM create the public resource policy for you when you pick NONE. If you use the CLI, CloudFormation or the API directly, you add it yourself. Deleting the URL does not delete that policy, so a stale public statement can remain.
Keep the function URL as the only door
AWS recommends adding the lambda:InvokedViaFunctionUrl condition key to resource policies. It limits the invoke permission to calls made through the function URL, not through other invocation methods. Without it, a broad principal may be able to invoke the function by other routes too.
Governing it across an organization
IAM policy actions exist for managing function URLs: create, update, get, list and delete configuration. You can use the lambda:FunctionUrlAuthType condition key in policies. AWS shows a service control policy that denies creating or updating function URLs with anything other than AWS_IAM. If your organization wants no public function URLs by default, that is the lever.
IAM Access Analyzer can also report external access to a function URL and flag new or changed permissions that grant public or cross-account access.
What auth type NONE does not give you
A public function still needs its own protections. It will receive requests from anyone, so the code has to validate input, avoid trusting caller-supplied identity, and be safe against abuse. Reserved concurrency (see reserved concurrency as a safety limit) caps how far a flood of requests can scale.
Checklist
- List every function URL in the account and its auth type.
- For each NONE, write down why it is public.
- Add the InvokedViaFunctionUrl condition to its resource policy.
- Set reserved concurrency.
- Consider an organization policy that denies NONE unless an exception is granted.
Click through it at your own pace, or open it full screen.
Quick check
Does auth type NONE mean the resource policy is ignored?
No. The resource policy always applies. It must grant public access before a NONE function URL accepts requests, otherwise callers get a 403.
Is a hard to guess function URL a form of security?
No. A URL can leak through logs, browser history or shared code. Treat auth type NONE as fully public.
Safeguard's free scan and asset discovery can help you find what you run and which dependencies sit behind a public endpoint.
Sources
Last reviewed: 19 October 2026.
