Lambda Function URLs & Direct Invocation

Q: Why does my public URL return 403?

A NONE (public) URL still needs a resource-based permission allowing anonymous invokes. Add one with Action="lambda:InvokeFunctionUrl", Principal="*", and FunctionUrlAuthType="NONE".

Q: What is the difference between AWS_IAM and NONE?

AWS_IAM requires SigV4-signed requests authorized by IAM. NONE is open to anyone with the URL, so you must authenticate inside the handler and add the matching public permission.

Q: When should I use Invoke instead of a URL?

When the caller is an AWS SDK with credentials. Invoke is the data-plane call, takes your raw payload, and avoids the HTTP request/response envelope a URL adds.

Q: Can a Function URL point at a specific version or alias?

Yes. Pass Qualifier to attach the URL to an alias or version. Without it, the URL fronts $LATEST, which tracks the mutable draft.

Q: Does the URL handle CORS?

Yes. Set the Cors block (AllowOrigins, AllowMethods, AllowHeaders, MaxAge) and Lambda enforces it at the URL, so browsers can call it without a proxy.

Q: What is InvokeMode used for?

BUFFERED returns the full response at once; RESPONSE_STREAM streams it back incrementally. Use streaming for large or progressive payloads on a supported runtime.

Q: How do I make a public URL private later?

Update AuthType to AWS_IAM and remove the public NONE permission statement. Both steps are needed, or anonymous access can persist.

A Function URL is a dedicated HTTPS endpoint for a single function - HTTP in, no API Gateway in between.

It is the simplest way to expose a function to the web or to a webhook sender. This page shows how to create and configure a Function URL from the SDK, how to choose and enforce its auth model, and the resource-based permission a public URL needs. It also contrasts a URL (HTTP trigger) with the SDK Invoke call (data-plane API) so you use the right door for each caller.

Recipe

Create the URL config with an auth type. For a public URL, also add the resource-based permission that allows anonymous invokes.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
url = lam.create_function_url_config(
    FunctionName="webhook",
    AuthType="NONE",           # public; use AWS_IAM to require signed requests
)
 
# A public URL still needs a resource-based permission to be reachable.
lam.add_permission(
    FunctionName="webhook",
    StatementId="AllowPublicFunctionUrl",
    Action="lambda:InvokeFunctionUrl",
    Principal="*",
    FunctionUrlAuthType="NONE",
)
print(url["FunctionUrl"])

// --- TypeScript (AWS SDK v3) ---
import {
  LambdaClient,
  CreateFunctionUrlConfigCommand,
  AddPermissionCommand,
} from "@aws-sdk/client-lambda";
 
const lam = new LambdaClient({});
const url = await lam.send(new CreateFunctionUrlConfigCommand({
  FunctionName: "webhook",
  AuthType: "NONE",            // public; use AWS_IAM to require signed requests
}));
 
// A public URL still needs a resource-based permission to be reachable.
await lam.send(new AddPermissionCommand({
  FunctionName: "webhook",
  StatementId: "AllowPublicFunctionUrl",
  Action: "lambda:InvokeFunctionUrl",
  Principal: "*",
  FunctionUrlAuthType: "NONE",
}));
console.log(url.FunctionUrl);

When to reach for this:

You want a plain HTTPS endpoint for a webhook or a simple service without API Gateway.
The caller speaks HTTP, not the AWS SDK, so it cannot use Invoke.
You want to stream a large or incremental response back over HTTP.
You need a quick public or IAM-protected entry point to one function.

Working Example

An IAM-protected URL with CORS and response streaming - the setup for an internal service other AWS principals call with signed requests.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
url = lam.create_function_url_config(
    FunctionName="report",
    Qualifier="prod",              # attach the URL to an alias
    AuthType="AWS_IAM",            # callers must sign with SigV4
    InvokeMode="RESPONSE_STREAM",  # stream the response back
    Cors={
        "AllowOrigins": ["https://app.example.com"],
        "AllowMethods": ["GET", "POST"],
        "AllowHeaders": ["content-type"],
        "MaxAge": 300,
    },
)
print(url["FunctionUrl"], url["AuthType"])

// --- TypeScript (AWS SDK v3) ---
import { LambdaClient, CreateFunctionUrlConfigCommand } from "@aws-sdk/client-lambda";
 
const lam = new LambdaClient({});
const url = await lam.send(new CreateFunctionUrlConfigCommand({
  FunctionName: "report",
  Qualifier: "prod",              // attach the URL to an alias
  AuthType: "AWS_IAM",            // callers must sign with SigV4
  InvokeMode: "RESPONSE_STREAM",  // stream the response back
  Cors: {
    AllowOrigins: ["https://app.example.com"],
    AllowMethods: ["GET", "POST"],
    AllowHeaders: ["content-type"],
    MaxAge: 300,
  },
}));
console.log(url.FunctionUrl, url.AuthType);

What this demonstrates:

AuthType: "AWS_IAM" requires every request to be SigV4-signed and authorized by IAM; no anonymous access.
Qualifier attaches the URL to a specific alias/version, so you can have separate prod and staging URLs.
InvokeMode: "RESPONSE_STREAM" streams the response instead of buffering it - good for large or progressive output.
Cors is enforced by Lambda at the URL, so browsers can call it directly without a proxy.

Deep Dive

Two Auth Models

AuthType is the security boundary:

AWS_IAM - callers sign requests with SigV4 and must have lambda:InvokeFunctionUrl permission. Use for service-to-service or authenticated clients.
NONE - anyone with the URL can call it. Use only for genuinely public endpoints, and pair it with an AddPermission statement whose FunctionUrlAuthType is NONE so Lambda allows anonymous invokes. Do your own auth (a signature header, a token) inside the handler.

The FunctionUrlAuthType condition on the permission must match the URL's AuthType. A NONE URL without the matching public permission returns 403.

URL Trigger vs the Invoke API

A Function URL and the Invoke API are different doors to the same function:

	Function URL	`Invoke` API
Protocol	HTTPS request	AWS SDK data-plane call
Caller	Anything that speaks HTTP	An AWS SDK with credentials
Auth	`AWS_IAM` (SigV4) or `NONE`	IAM (`lambda:InvokeFunction`)
Event shape	HTTP request/response JSON envelope	Your raw payload
Best for	Webhooks, browsers, non-AWS callers	Backend-to-Lambda from AWS SDKs

If your caller already uses an AWS SDK, Invoke is simpler and avoids the HTTP envelope. If it does not, a Function URL is the lightweight way in.

Managing the URL Config

get_function_url_config, update_function_url_config, and delete_function_url_config round out the lifecycle. Changing AuthType from NONE to AWS_IAM should be paired with removing the public permission, so anonymous access truly stops.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
lam.update_function_url_config(FunctionName="webhook", AuthType="AWS_IAM")
lam.remove_permission(FunctionName="webhook", StatementId="AllowPublicFunctionUrl")

// --- TypeScript (AWS SDK v3) ---
import {
  LambdaClient,
  UpdateFunctionUrlConfigCommand,
  RemovePermissionCommand,
} from "@aws-sdk/client-lambda";
 
const lam = new LambdaClient({});
await lam.send(new UpdateFunctionUrlConfigCommand({ FunctionName: "webhook", AuthType: "AWS_IAM" }));
await lam.send(new RemovePermissionCommand({ FunctionName: "webhook", StatementId: "AllowPublicFunctionUrl" }));

Gotchas

Public URL returns 403. A NONE URL is not reachable without the matching permission. Fix: add_permission with Action="lambda:InvokeFunctionUrl", Principal="*", FunctionUrlAuthType="NONE".
Mismatched auth condition. The permission's FunctionUrlAuthType must equal the URL's AuthType. Fix: keep them in sync.
Leaving a public permission after tightening auth. Switching to AWS_IAM without removing the NONE statement can leave a gap. Fix: remove_permission for the public statement.
Expecting a raw payload at the URL. A URL delivers an HTTP-shaped event, not your bare Invoke payload. Fix: parse the request envelope in the handler.
No CORS for a browser caller. Without Cors, browser requests fail preflight. Fix: set AllowOrigins/AllowMethods/AllowHeaders.
Assuming a URL can front $LATEST safely. It can, but then it tracks the mutable draft. Fix: use Qualifier to attach the URL to an alias.

Alternatives

Alternative	Use When	Don't Use When
Function URL	You need a simple HTTPS endpoint or webhook target	You need routing, throttling, or usage plans
`Invoke` API	The caller is an AWS SDK with credentials	The caller only speaks HTTP
API Gateway	You need routes, authorizers, throttling, custom domains	A single-function endpoint is all you need
Application Load Balancer target	You want a function behind an existing ALB	You want the simplest standalone endpoint

FAQs

What is a Lambda Function URL?

A dedicated HTTPS endpoint bound to one function, created with CreateFunctionUrlConfig. It lets HTTP clients invoke the function directly without API Gateway.

Why does my public URL return 403?

A NONE (public) URL still needs a resource-based permission allowing anonymous invokes. Add one with Action="lambda:InvokeFunctionUrl", Principal="*", and FunctionUrlAuthType="NONE".

What is the difference between AWS_IAM and NONE?

AWS_IAM requires SigV4-signed requests authorized by IAM. NONE is open to anyone with the URL, so you must authenticate inside the handler and add the matching public permission.

When should I use Invoke instead of a URL?

When the caller is an AWS SDK with credentials. Invoke is the data-plane call, takes your raw payload, and avoids the HTTP request/response envelope a URL adds.

Can a Function URL point at a specific version or alias?

Yes. Pass Qualifier to attach the URL to an alias or version. Without it, the URL fronts $LATEST, which tracks the mutable draft.

Does the URL handle CORS?

Yes. Set the Cors block (AllowOrigins, AllowMethods, AllowHeaders, MaxAge) and Lambda enforces it at the URL, so browsers can call it without a proxy.

What is InvokeMode used for?

BUFFERED returns the full response at once; RESPONSE_STREAM streams it back incrementally. Use streaming for large or progressive payloads on a supported runtime.

How do I make a public URL private later?

Update AuthType to AWS_IAM and remove the public NONE permission statement. Both steps are needed, or anonymous access can persist.

Lambda Deep Dive Basics - the Invoke API this page contrasts with.
Versions, Aliases & Traffic Shifting - the qualifiers a URL can attach to.
Lambda's Execution Model for SDK Callers - control plane vs data plane.
Lambda via SDK Best Practices - permission and observability defaults.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

Recipe

Create the URL config with an auth type. For a public URL, also add the resource-based permission that allows anonymous invokes.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
url = lam.create_function_url_config(
    FunctionName="webhook",
    AuthType="NONE",           # public; use AWS_IAM to require signed requests
)
 
# A public URL still needs a resource-based permission to be reachable.
lam.add_permission(
    FunctionName="webhook",
    StatementId="AllowPublicFunctionUrl",
    Action="lambda:InvokeFunctionUrl",
    Principal="*",
    FunctionUrlAuthType="NONE",
)
print(url["FunctionUrl"])

// --- TypeScript (AWS SDK v3) ---
import {
  LambdaClient,
  CreateFunctionUrlConfigCommand,
  AddPermissionCommand,
} from "@aws-sdk/client-lambda";
 
const lam = new LambdaClient({});
const url = await lam.send(new CreateFunctionUrlConfigCommand({
  FunctionName: "webhook",
  AuthType: "NONE",            // public; use AWS_IAM to require signed requests
}));
 
// A public URL still needs a resource-based permission to be reachable.
await lam.send(new AddPermissionCommand({
  FunctionName: "webhook",
  StatementId: "AllowPublicFunctionUrl",
  Action: "lambda:InvokeFunctionUrl",
  Principal: "*",
  FunctionUrlAuthType: "NONE",
}));
console.log(url.FunctionUrl);

When to reach for this:

You want a plain HTTPS endpoint for a webhook or a simple service without API Gateway.
The caller speaks HTTP, not the AWS SDK, so it cannot use Invoke.
You want to stream a large or incremental response back over HTTP.
You need a quick public or IAM-protected entry point to one function.

Working Example

An IAM-protected URL with CORS and response streaming - the setup for an internal service other AWS principals call with signed requests.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
url = lam.create_function_url_config(
    FunctionName="report",
    Qualifier="prod",              # attach the URL to an alias
    AuthType="AWS_IAM",            # callers must sign with SigV4
    InvokeMode="RESPONSE_STREAM",  # stream the response back
    Cors={
        "AllowOrigins": ["https://app.example.com"],
        "AllowMethods": ["GET", "POST"],
        "AllowHeaders": ["content-type"],
        "MaxAge": 300,
    },
)
print(url["FunctionUrl"], url["AuthType"])

// --- TypeScript (AWS SDK v3) ---
import { LambdaClient, CreateFunctionUrlConfigCommand } from "@aws-sdk/client-lambda";
 
const lam = new LambdaClient({});
const url = await lam.send(new CreateFunctionUrlConfigCommand({
  FunctionName: "report",
  Qualifier: "prod",              // attach the URL to an alias
  AuthType: "AWS_IAM",            // callers must sign with SigV4
  InvokeMode: "RESPONSE_STREAM",  // stream the response back
  Cors: {
    AllowOrigins: ["https://app.example.com"],
    AllowMethods: ["GET", "POST"],
    AllowHeaders: ["content-type"],
    MaxAge: 300,
  },
}));
console.log(url.FunctionUrl, url.AuthType);

What this demonstrates:

AuthType: "AWS_IAM" requires every request to be SigV4-signed and authorized by IAM; no anonymous access.
Qualifier attaches the URL to a specific alias/version, so you can have separate prod and staging URLs.
InvokeMode: "RESPONSE_STREAM" streams the response instead of buffering it - good for large or progressive output.
Cors is enforced by Lambda at the URL, so browsers can call it directly without a proxy.

Deep Dive

Two Auth Models

AuthType is the security boundary:

AWS_IAM - callers sign requests with SigV4 and must have lambda:InvokeFunctionUrl permission. Use for service-to-service or authenticated clients.
NONE - anyone with the URL can call it. Use only for genuinely public endpoints, and pair it with an AddPermission statement whose FunctionUrlAuthType is NONE so Lambda allows anonymous invokes. Do your own auth (a signature header, a token) inside the handler.

The FunctionUrlAuthType condition on the permission must match the URL's AuthType. A NONE URL without the matching public permission returns 403.

URL Trigger vs the Invoke API

A Function URL and the Invoke API are different doors to the same function:

	Function URL	`Invoke` API
Protocol	HTTPS request	AWS SDK data-plane call
Caller	Anything that speaks HTTP	An AWS SDK with credentials
Auth	`AWS_IAM` (SigV4) or `NONE`	IAM (`lambda:InvokeFunction`)
Event shape	HTTP request/response JSON envelope	Your raw payload
Best for	Webhooks, browsers, non-AWS callers	Backend-to-Lambda from AWS SDKs

If your caller already uses an AWS SDK, Invoke is simpler and avoids the HTTP envelope. If it does not, a Function URL is the lightweight way in.

Managing the URL Config

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
lam.update_function_url_config(FunctionName="webhook", AuthType="AWS_IAM")
lam.remove_permission(FunctionName="webhook", StatementId="AllowPublicFunctionUrl")

// --- TypeScript (AWS SDK v3) ---
import {
  LambdaClient,
  UpdateFunctionUrlConfigCommand,
  RemovePermissionCommand,
} from "@aws-sdk/client-lambda";
 
const lam = new LambdaClient({});
await lam.send(new UpdateFunctionUrlConfigCommand({ FunctionName: "webhook", AuthType: "AWS_IAM" }));
await lam.send(new RemovePermissionCommand({ FunctionName: "webhook", StatementId: "AllowPublicFunctionUrl" }));

Gotchas

Public URL returns 403. A NONE URL is not reachable without the matching permission. Fix: add_permission with Action="lambda:InvokeFunctionUrl", Principal="*", FunctionUrlAuthType="NONE".
Mismatched auth condition. The permission's FunctionUrlAuthType must equal the URL's AuthType. Fix: keep them in sync.
Leaving a public permission after tightening auth. Switching to AWS_IAM without removing the NONE statement can leave a gap. Fix: remove_permission for the public statement.
Expecting a raw payload at the URL. A URL delivers an HTTP-shaped event, not your bare Invoke payload. Fix: parse the request envelope in the handler.
No CORS for a browser caller. Without Cors, browser requests fail preflight. Fix: set AllowOrigins/AllowMethods/AllowHeaders.
Assuming a URL can front $LATEST safely. It can, but then it tracks the mutable draft. Fix: use Qualifier to attach the URL to an alias.

Alternatives

Alternative	Use When	Don't Use When
Function URL	You need a simple HTTPS endpoint or webhook target	You need routing, throttling, or usage plans
`Invoke` API	The caller is an AWS SDK with credentials	The caller only speaks HTTP
API Gateway	You need routes, authorizers, throttling, custom domains	A single-function endpoint is all you need
Application Load Balancer target	You want a function behind an existing ALB	You want the simplest standalone endpoint

FAQs

What is a Lambda Function URL?

A dedicated HTTPS endpoint bound to one function, created with CreateFunctionUrlConfig. It lets HTTP clients invoke the function directly without API Gateway.

Why does my public URL return 403?

A NONE (public) URL still needs a resource-based permission allowing anonymous invokes. Add one with Action="lambda:InvokeFunctionUrl", Principal="*", and FunctionUrlAuthType="NONE".

What is the difference between AWS_IAM and NONE?

AWS_IAM requires SigV4-signed requests authorized by IAM. NONE is open to anyone with the URL, so you must authenticate inside the handler and add the matching public permission.

When should I use Invoke instead of a URL?

When the caller is an AWS SDK with credentials. Invoke is the data-plane call, takes your raw payload, and avoids the HTTP request/response envelope a URL adds.

Can a Function URL point at a specific version or alias?

Yes. Pass Qualifier to attach the URL to an alias or version. Without it, the URL fronts $LATEST, which tracks the mutable draft.

Does the URL handle CORS?

Yes. Set the Cors block (AllowOrigins, AllowMethods, AllowHeaders, MaxAge) and Lambda enforces it at the URL, so browsers can call it without a proxy.

What is InvokeMode used for?

BUFFERED returns the full response at once; RESPONSE_STREAM streams it back incrementally. Use streaming for large or progressive payloads on a supported runtime.

How do I make a public URL private later?

Update AuthType to AWS_IAM and remove the public NONE permission statement. Both steps are needed, or anonymous access can persist.

Lambda Deep Dive Basics - the Invoke API this page contrasts with.
Versions, Aliases & Traffic Shifting - the qualifiers a URL can attach to.
Lambda's Execution Model for SDK Callers - control plane vs data plane.
Lambda via SDK Best Practices - permission and observability defaults.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

Lambda Function URLs & Direct Invocation

Buscar en la documentación

Lambda Function URLs & Direct Invocation