CloudFront distributions should use origin access control for Lambda function URL origins
Flags Amazon CloudFront distributions that use AWS Lambda function URLs as origins without origin access control (OAC) enabled. Without OAC, the Lambda function URL is publicly reachable and bypasses the protections CloudFront provides.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Attach an origin access control to every Lambda function URL origin on the distribution. That alone locks nothing down: set the function URL's auth type to AWS_IAM, and give the function a resource policy letting the cloudfront.amazonaws.com service principal invoke it under a condition naming this distribution's ARN. The Lambda console cannot edit that policy, so add it through the API or the command line, and add it before attaching the OAC or requests fail in the gap. Callers change too: a client sending a POST or a PUT through the distribution must then compute the SHA256 of the body and send it in the x-amz-content-sha256 header.
In the console
CloudFront → Distributions → the distribution → Origins → the Lambda function URL origin → Origin access control
See which of your accounts this check is failing on.
Book a demo