Lambda Function URLs

A Lambda Function URL is a dedicated HTTPS endpoint for a Lambda function. It is a native feature of AWS Lambda, introduced in April 2022, that allows you to invoke a function directly via HTTP without needing an intermediary like API Gateway or Application Load Balancer. The URL is automatically generated when you create it, and it follows the format: https://<url-id>.lambda-url.<region>.on.aws/. The url-id is a unique 12-character alphanumeric string generated by AWS. Each function can have only one Function URL at a time, but you can delete and recreate it to get a new URL.

Before Function URLs, the only way to expose a Lambda function to HTTP requests was through API Gateway (REST or HTTP API), ALB, or a custom integration with CloudFront. These services add complexity, cost, and latency. Function URLs provide a simpler, cheaper alternative for use cases where you don't need the advanced features of API Gateway, such as request validation, throttling, API keys, usage plans, custom domains, or WAF integration. Common use cases include webhooks, simple APIs, and serverless backend for single-page applications.

When a client sends an HTTPS request to the Function URL, AWS Lambda's infrastructure receives it and performs the following steps:

- URL Format: https://<url-id>.lambda-url.<region>.on.aws/. The url-id is unique per region and account. - Auth Types: - NONE: No authentication. Anyone with the URL can invoke the function. - AWS_IAM: Requests must be signed with IAM credentials that have lambda:InvokeFunctionUrl permission. - CORS: You can configure CORS headers (AllowOrigins, AllowMethods, AllowHeaders, ExposeHeaders, MaxAge, AllowCredentials) when creating the URL. These are returned in preflight OPTIONS responses automatically. If not configured, CORS is disabled. - Throttling: Function URLs are subject to the same concurrency limits as the function. There is no separate throttling mechanism. The default reserved concurrency is 1,000 per region but can be increased. If the function is throttled, the request receives a 429 Too Many Requests response. - Timeout: The function timeout applies (max 15 minutes). The URL itself has no separate timeout. - Payload Size: The maximum request/response payload size is 6 MB (same as synchronous invocation). - Headers: Certain headers are restricted and cannot be set in the response (e.g., Connection, Transfer-Encoding, Via, X-Forwarded-For). - Logging: All invocations are logged in CloudWatch Logs if the function has logging enabled. There is no access logging at the URL level.

You can create a Function URL using the AWS CLI, SDK, or CloudFormation. Example CLI command to create a URL with AWS_IAM auth:

aws lambda create-function-url-config --function-name my-function --auth-type AWS_IAM --cors '{"AllowOrigins":["https://example.com"],"AllowMethods":["GET","POST"]}'

To get the URL:

aws lambda get-function-url-config --function-name my-function

To update auth type:

aws lambda update-function-url-config --function-name my-function --auth-type NONE

To delete:

aws lambda delete-function-url-config --function-name my-function

In CloudFormation:

MyFunctionUrl:
  Type: AWS::Lambda::Url
  Properties:
    TargetFunctionArn: !GetAtt MyFunction.Arn
    AuthType: AWS_IAM
    Cors:
      AllowOrigins:
        - "https://example.com"
      AllowMethods:
        - "GET"
        - "POST"

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "lambda:InvokeFunctionUrl",
            "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function"
        }
    ]
}

API Gateway HTTP API is the closest alternative. It also offers a simple, low-cost API endpoint. Key differences:

In summary, Function URLs are ideal for simple, single-endpoint use cases where you want to avoid the overhead and cost of API Gateway. For anything more complex, use API Gateway.

A SaaS company needs to handle Stripe webhooks for payment events. They have a Lambda function that processes the event and updates the database. Using API Gateway would add cost and complexity for a single endpoint. They create a Function URL with auth type NONE (since Stripe signs the webhook payload with a secret, not AWS IAM). They configure the URL and provide it to Stripe. The function verifies the Stripe signature inside the code. They also configure CORS if needed (not for webhooks). The URL is simple and cost-effective. At scale, they handle thousands of webhooks per second. The main concern is throttling: if the function's reserved concurrency is too low, Stripe may receive 429 errors. They set reserved concurrency to 500 to handle peak load. Misconfiguration: if they accidentally set auth type to AWS_IAM, Stripe cannot invoke the function, and they get 403 errors. They also need to ensure the function logs errors to CloudWatch for debugging.

A company builds an internal dashboard SPA that fetches data from a Lambda function. The SPA is hosted on a private corporate domain. They want to restrict access to employees only. They create a Function URL with auth type AWS_IAM. The SPA uses a Cognito Identity Pool to get temporary AWS credentials. The JavaScript client signs the request using the AWS SDK for JavaScript. The function returns JSON data. CORS is configured to allow the corporate domain. The URL is not exposed to the public internet. This setup is simpler than API Gateway because they don't need custom domains or API keys. At scale, they handle 1000 concurrent users. The main challenge is CORS: if the CORS configuration is missing or incorrect, the browser blocks the request. They also need to ensure the IAM role for the identity pool has the lambda:InvokeFunctionUrl permission. Misconfiguration: if they set auth type to NONE, anyone can access the function, which is a security risk.

A startup is building a new feature and wants to quickly test an API endpoint. They use a Function URL to avoid the overhead of setting up API Gateway. They set auth type to NONE for simplicity. The function returns mock data. Once the prototype is validated, they plan to migrate to API Gateway for production. The URL is easy to share with frontend developers. The main risk is that the endpoint is publicly accessible and could be abused. They mitigate by using a unique, hard-to-guess URL and monitoring CloudWatch logs for unusual activity. They also set a low reserved concurrency to limit impact. Misconfiguration: they forget to delete the URL after moving to production, leaving an unsecured endpoint that could leak data.