Find Public Lambda Function URLs (AuthType NONE)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListFunctionsAndRegions",
      "Effect": "Allow",
      "Action": ["lambda:ListFunctions", "ec2:DescribeRegions"],
      "Resource": "*"
    },
    {
      "Sid": "ReadUrlConfigsAndPolicies",
      "Effect": "Allow",
      "Action": ["lambda:ListFunctionUrlConfigs", "lambda:GetPolicy"],
      "Resource": "arn:aws:lambda:*:123456789012:function:*"
    }
  ]
}

// find-public-lambda-function-urls.ts
// Lists every Lambda function URL in every enabled Region, its AuthType, whether the function's
// resource-based policy lets anyone ("*") invoke it, and whether CORS allows any origin.
// Read-only: it never changes a function, URL or policy.
// Usage: npx tsx find-public-lambda-function-urls.ts [--regions=us-east-1,eu-west-1]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  LambdaClient,
  GetPolicyCommand,
  ResourceNotFoundException,
  paginateListFunctions,
  paginateListFunctionUrlConfigs,
  type FunctionUrlConfig,
} from "@aws-sdk/client-lambda";

const regionArg = process.argv.find((a) => a.startsWith("--regions="))?.split("=")[1];

interface Statement { Effect?: string; Principal?: unknown; Action?: string | string[]; Condition?: Record<string, Record<string, unknown>> }
interface Row { Region: string; Function: string; Qualifier: string; AuthType: string; PublicPolicy: string; CorsOrigins: string; Verdict: string }

// Condition keys that only describe the function URL; anything else (aws:SourceAccount, aws:PrincipalOrgID ...) narrows access.
const URL_ONLY_KEYS = new Set(["lambda:functionurlauthtype", "lambda:invokedviafunctionurl"]);

function isEveryone(principal: unknown): boolean {
  if (principal === "*") return true;
  if (principal && typeof principal === "object" && "AWS" in principal) {
    const aws = (principal as { AWS: unknown }).AWS;
    return aws === "*" || (Array.isArray(aws) && aws.includes("*"));
  }
  return false;
}

function allows(stmt: Statement, action: string): boolean {
  const actions = Array.isArray(stmt.Action) ? stmt.Action : [stmt.Action ?? ""];
  return actions.some((a) => a === "*" || a === "lambda:*" || a.toLowerCase() === action.toLowerCase());
}

function unrestricted(stmt: Statement): boolean {
  const entries = Object.values(stmt.Condition ?? {}).flatMap((block) => Object.entries(block));
  return entries.every(([key, value]) => {
    const k = key.toLowerCase();
    if (k === "lambda:functionurlauthtype") return String(value).toUpperCase() === "NONE"; // an AWS_IAM-only grant isn't public
    return URL_ONLY_KEYS.has(k);
  });
}

async function publicActions(lambda: LambdaClient, fn: string, qualifier?: string): Promise<string[]> {
  try {
    const res = await lambda.send(new GetPolicyCommand({ FunctionName: fn, Qualifier: qualifier }));
    const doc = JSON.parse(res.Policy ?? "{}") as { Statement?: Statement[] };
    const open = (doc.Statement ?? []).filter((s) => s.Effect === "Allow" && isEveryone(s.Principal) && unrestricted(s));
    return ["lambda:InvokeFunctionUrl", "lambda:InvokeFunction"].filter((a) => open.some((s) => allows(s, a)));
  } catch (err) {
    if (err instanceof ResourceNotFoundException) return []; // no resource-based policy at all
    throw err;
  }
}

function verdict(url: FunctionUrlConfig, open: string[]): string {
  if (url.AuthType === "AWS_IAM") return "IAM auth (signed requests only)";
  if (open.includes("lambda:InvokeFunctionUrl")) return "PUBLIC: anyone with the URL can invoke";
  return "AuthType NONE but no public grant (403)";
}

async function scanRegion(region: string): Promise<Row[]> {
  const lambda = new LambdaClient({ region });
  const rows: Row[] = [];
  for await (const page of paginateListFunctions({ client: lambda }, {})) {
    for (const fn of page.Functions ?? []) {
      const name = fn.FunctionName ?? "";
      for await (const urls of paginateListFunctionUrlConfigs({ client: lambda }, { FunctionName: name })) {
        for (const url of urls.FunctionUrlConfigs ?? []) {
          // A URL on an alias has a qualified ARN: arn:aws:lambda:region:account:function:name:alias
          const parts = (url.FunctionArn ?? "").split(":");
          const qualifier = parts.length > 7 ? parts[7] : undefined;
          const open = await publicActions(lambda, name, qualifier);
          const origins = url.Cors?.AllowOrigins ?? [];
          rows.push({
            Region: region,
            Function: name,
            Qualifier: qualifier ?? "$LATEST",
            AuthType: url.AuthType ?? "",
            PublicPolicy: open.length ? open.join(" + ") : "none",
            CorsOrigins: origins.includes("*") ? "* (any site)" : origins.join(", ") || "not set",
            Verdict: verdict(url, open),
          });
        }
      }
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const regions = regionArg
    ? regionArg.split(",")
    : ((await new EC2Client({}).send(new DescribeRegionsCommand({}))).Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean);
  const rows: Row[] = [];
  for (const region of regions.sort()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: skipped (${err instanceof Error ? err.name + ": " + err.message : String(err)})`);
    }
  }
  console.table(rows);
  const pub = rows.filter((r) => r.Verdict.startsWith("PUBLIC"));
  console.log(`${rows.length} function URLs in ${regions.length} Regions; ${pub.length} public.`);
  console.log("Read-only: nothing was changed.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-lambda @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Every enabled Region
AWS_PROFILE=readonly npx tsx find-public-lambda-function-urls.ts

# Only two Regions
AWS_PROFILE=readonly npx tsx find-public-lambda-function-urls.ts --regions=us-east-1,eu-west-1

┌─────────┬─────────────┬──────────────────┬───────────┬───────────┬────────────────────────────────────────────────────┬───────────────────────────┬───────────────────────────────────────────┐
│ (index) │ Region      │ Function         │ Qualifier │ AuthType  │ PublicPolicy                                       │ CorsOrigins               │ Verdict                                   │
├─────────┼─────────────┼──────────────────┼───────────┼───────────┼────────────────────────────────────────────────────┼───────────────────────────┼───────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'stripe-webhook' │ '$LATEST' │ 'NONE'    │ 'lambda:InvokeFunctionUrl + lambda:InvokeFunction' │ 'not set'                 │ 'PUBLIC: anyone with the URL can invoke'  │
│ 1       │ 'us-east-1' │ 'report-export'  │ 'prod'    │ 'NONE'    │ 'lambda:InvokeFunctionUrl'                         │ '* (any site)'            │ 'PUBLIC: anyone with the URL can invoke'  │
│ 2       │ 'us-east-1' │ 'demo-hello'     │ '$LATEST' │ 'NONE'    │ 'none'                                             │ 'not set'                 │ 'AuthType NONE but no public grant (403)' │
│ 3       │ 'us-east-1' │ 'internal-api'   │ '$LATEST' │ 'AWS_IAM' │ 'none'                                             │ 'https://app.example.com' │ 'IAM auth (signed requests only)'         │
└─────────┴─────────────┴──────────────────┴───────────┴───────────┴────────────────────────────────────────────────────┴───────────────────────────┴───────────────────────────────────────────┘
4 function URLs in 17 Regions; 2 public.
Read-only: nothing was changed.