AWS CloudTrail: CreateFunctionUrlConfig Indicates Lambda Function URL Added
Flags when a Lambda Function URL configuration is created via the CreateFunctionUrlConfig API call.
FreeReviewedSigma · Medium · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Ivan Saakov (SigmaHQ), DRL 1.1
- Published
- 2024-12-19
- Updated
- 2026-07-31
What it detects
This rule identifies CloudTrail events where a user creates a Lambda function URL configuration. Exposing a function via a public URL can enable unintended access paths and may allow an attacker to leverage the Lambda function’s associated permissions when combined with other conditions. The detection relies on AWS CloudTrail telemetry capturing eventSource=lambda.amazonaws.com and eventName=CreateFunctionUrlConfig.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
- cloud.hacktricks.xyzhttps://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
- wiz.iohttps://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-cloudtrail-lambda-function-url-configuration-created-ec541962
title: "AWS CloudTrail: CreateFunctionUrlConfig Indicates Lambda Function URL Added"
id: 6aef5525-e934-4692-a642-3b588e495999
status: experimental
description: This rule identifies CloudTrail events where a user creates a Lambda function URL configuration. Exposing a function via a public URL can enable unintended access paths and may allow an attacker to leverage the Lambda function’s associated permissions when combined with other conditions. The detection relies on AWS CloudTrail telemetry capturing eventSource=lambda.amazonaws.com and eventName=CreateFunctionUrlConfig.
references:
- https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
- attack.initial-access
- attack.privilege-escalation
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: lambda.amazonaws.com
eventName: CreateFunctionUrlConfig
condition: selection
falsepositives:
- Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: ec541962-c05a-4420-b9ea-84de072d18f4
type: derived