A company's developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production…

The correct answer is D. Use SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig. Explanation Option D is correct because Service Control Policies (SCPs) in AWS Organizations can be applied at the organizational unit (OU) or account level to deny the lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions unless the AuthType condition is…

Submitted by marco_it· Mar 6, 2026Identity and Access Management (IAM)

Question

A company's developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production accounts. The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers. Which solution will meet these requirements?

Options

ARequire the developers to configure all function URLs to support cross-origin resource sharing
BUse an AWS WAF delegated administrator account to view and block unauthenticated access to
CUse SCPs to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig
DUse SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig

How the community answered

(23 responses)

A
4% (1)
B
4% (1)
C
9% (2)
D
83% (19)

Explanation

Option D is correct because Service Control Policies (SCPs) in AWS Organizations can be applied at the organizational unit (OU) or account level to deny the lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions unless the AuthType condition is set to AWS_IAM. This enforces authentication at the policy level across all production accounts automatically, requiring no additional action from developers - the restriction is transparently enforced by the organization.

Option A is wrong because configuring CORS is a security mechanism for browser-based cross-origin requests, not an authentication control - it does nothing to prevent unauthenticated function invocations.

Option B is wrong because AWS WAF can help filter and block requests, but it doesn't prevent developers from deploying unauthenticated function URLs in the first place - it only acts after deployment, and adds operational complexity.

Option C is wrong because simply allowing those Lambda actions does nothing to restrict unauthenticated configurations - you need to deny configurations that lack authentication, not permit all configurations broadly.

Memory Tip: Think "SCPs = Guard Rails" - SCPs don't grant permissions, they restrict them. When you need to prevent a specific misconfiguration organization-wide with zero developer overhead, SCPs with a Deny statement are the go-to AWS Organizations tool.

Topics

#AWS Organizations#Service Control Policies (SCPs)#AWS Lambda Function URLs#Access Control

Community Discussion

No community discussion yet for this question.

Full SCS-C03 Practice