AWS has announced a security-related change affecting Lambda Function URL execution permissions. Beginning November 1, 2026, AWS will enforce additional authorization requirements for Lambda Function URLs. BaaS services deployed using deployment artifacts older than November 30, 2025 do not contain the updated permissions required by AWS.
Who is affected?
You may be affected if you have one or more BaaS services that were last deployed before November 30, 2025 and have not been redeployed since that date.
What action is required?
You must redeploy all BaaS services with a deployment date earlier than November 30, 2025.
A redeployment will ensure that the service receives the updated AWS Lambda Function URL permissions and security configuration required to remain compatible with the upcoming AWS enforcement changes.
Why is this necessary?
AWS announced changes to Lambda Function URL execution permissions in late 2025. BaaS services deployed after the change automatically receive the updated configuration. However, services that have remained unchanged since before November 30, 2025 may continue to use legacy permissions. After AWS enforcement takes effect, these older deployments may experience invocation failures or service interruptions.
Recommended timeline
We recommend completing all redeployments as soon as possible, ideally allowing sufficient time for validation before AWS begins enforcing the new security requirements. Whenever applicable, test in DEV, TRN or TST tenants before proceeding to the PRD tenant.
How to verify whether services need to be redeployed
- Open API Gateway.
- Navigate to Backend As A Service > Services.
- In the service list view, sort by "Last Deployed Ascending".
- Review the column Deployed on. If all dates are newer than November 30 2025, no further action is needed.
How to redeploy affected services
- Follow the steps of "How to verify if your service needs to be redeployed" above.
- For each applicable service in the service list, click Service Actions.
- Select Redeploy.
- Confirm by clicking Yes.
Wait for the redeployment to complete. During redeployment, the menu option is inactive.
Verify that the service still is functional by testing the suite endpoints in Available APIs.
Need assistance?
If you are unsure whether your services are affected or require help identifying deployments that predate November 30, 2025, please comment on this post.
Thank you for your cooperation in helping ensure continued service availability and compliance with AWS security requirements.
