AWS Lambda function URL AuthType set to NONE misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_258
Category - Subcategory	Public Exposure - APIs
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform
Mapped CSPM/KSPM Rule	92a3fce2-0875-49da-af5c-71c3366100bf

Impact

This rule identifies AWS Lambda functions which have function URL AuthType set to NONE. AuthType determines how Lambda authenticates or authorises requests to your function URL. When AuthType is set to NONE, Lambda doesn't perform any authentication before invoking your function. It is highly recommended to set AuthType to AWS_IAM for Lambda function URL to authenticate via AWS IAM.

How to Fix

To fix this issue, ensure that the AuthType property in the AWS::Lambda::Url resource is set to a value other than None. For example, you can set it to AWS_IAM to enforce IAM-based authentication.

Example: [source,go]

{ "Resources": { "MyLambdaFunctionURL": { "Type": "AWS::Lambda::Url", "Properties": {

• "AuthType": None,
• "AuthType": "AWS_IAM", ... } } } }

---

Resources: MyLambdaFunctionURL: Type: AWS::Lambda::Url Properties:

• AuthType: None
• AuthType: AWS_IAM ...

---