AWS_IAM Lambda Function URL: an IAM role (and CloudFront OAC) gets 403, but an IAM user succeeds — why?

Question

I have a Lambda function whose Function URL is configured with AuthType = AWS_IAM (us-east-1).

Behavior:
- SigV4-signing a request to the Function URL as an IAM USER (which has lambda:InvokeFunctionUrl) -> HTTP 200.
- Signing the IDENTICAL request as an IAM ROLE that also has lambda:InvokeFunctionUrl -> HTTP 403 "Forbidden. For troubleshooting Function URL authorization issues..."
- Putting CloudFront in front of the Function URL via Origin Access Control (OAC, service principal cloudfront.amazonaws.com) -> also 403.
- Setting AuthType = NONE (public) with a public resource-based policy -> also 403.

So only an interactive IAM user can invoke it; an IAM role, the CloudFront service principal, and anonymous are all denied.

What I've already ruled out:
1) The role has lambda:InvokeFunctionUrl. aws iam simulate-principal-policy (role as source, action lambda:InvokeFunctionUrl, the function ARN as resource) returns EvalDecision = "allowed" and OrganizationsDecisionDetail = null (no SCP/RCP denial).
2) The function's resource-based policy explicitly allows the role (Action lambda:InvokeFunctionUrl, Condition lambda:FunctionUrlAuthType = AWS_IAM).
3) This is the AWS Organizations MANAGEMENT account (which is exempt from SCPs anyway). There are no Resource Control Policies, only the default FullAWSAccess SCP, and no AWS Control Tower landing zone.
4) The signing is correct: identical signing code yields 200 with the user's temporary credentials (sts get-session-token) and 403 with the role's temporary credentials (sts assume-role) — same signed headers (host, x-amz-content-sha256, x-amz-date, x-amz-security-token), only the principal differs.

Questions:
1) What account-level or service-level mechanism would cause an IAM role (and the CloudFront OAC service principal) to be denied on an AWS_IAM Function URL, while an IAM user with the same permission succeeds — when IAM Policy Simulator reports the role as "allowed" and no SCP/RCP applies?
2) How do I allow an IAM role and CloudFront OAC to invoke this Function URL? (Goal: front a private AWS_IAM Function URL with CloudFront.)

Riku_Kobayashi · Answer

Hello.

You may have already checked this, but is there an IAM policy set up in your IAM role that also allows "lambda:InvokeFunction"?  
https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html?utm_source  
> Starting in October 2025, new function URLs will require both lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions.

If "lambda:InvokeFunctionUrl" and "lambda:InvokeFunction" are permitted in the IAM policy and the Lambda resource-based policy, then I believe it can also be used with IAM roles.  
```
CREDS=$(aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/testRole \
  --role-session-name test)

export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r '.Credentials.SessionToken')
export AWS_DEFAULT_REGION=us-east-1

curl --aws-sigv4 "aws:amz:us-east-1:lambda" \
  --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
  -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
  https://xxxxx.lambda-url.us-east-1.on.aws/
```

AWS_IAM Lambda Function URL: an IAM role (and CloudFront OAC) gets 403, but an IAM user succeeds — why?

Add your answer

Relevant content