25651574678

Committed 11 May 2026 05:11AM UTC coverage: 74.734% (-0.08%) from 74.816%

Build # 25651574678

Build Type

push

github

Committed by

web-flow

Commit Message

:memo: README: document two-statement resource policy for Function URLs (#1455)

When `function_url_enabled` is true with `authorizer: NONE`,
`update_function_url_policy` (zappa/core.py) attaches BOTH
`lambda:InvokeFunctionUrl` AND `lambda:InvokeFunction` to
`Principal: "*"` — the behaviour set up in #1393 to match AWS's actual
requirement.

The AWS docs example at
https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html only shows
the first statement, so users adding Function URLs manually outside
Zappa (e.g. via `aws lambda create-function-url-config` + a single
`aws lambda add-permission` for `lambda:InvokeFunctionUrl`) hit 403
``AccessDeniedException`` and assume the Lambda is misconfigured.

This note documents what Zappa already does and points readers at the
two-statement shape, so anyone reverse-engineering Zappa's policy
to set up Function URLs themselves does not have to discover the
second statement empirically.

Coverage Stats

3650 of 4884 relevant lines covered (74.73%)

4.48 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

74.32

/cli.py

Source Not Available

The file "cli.py" isn't available on github. Either it's been removed, or the repo root directory needs to be updated.

zappa / Zappa / 25651574678

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available

Source File
Press 'n' to go to next uncovered line, 'b' for previous