Fix AWS Lambda Function URL 403 Forbidden Error with RESPONSE_STREAM Invoke Mode

[universe-ops]

Problem

AWS Lambda Function URLs with AuthorizationType: "NONE" and InvokeMode: "RESPONSE_STREAM" were returning 403 Forbidden errors immediately after deployment. Users had to manually change the invoke mode to BUFFERED and back to RESPONSE_STREAM in the AWS Console to make the Function URL accessible.

Root Cause

AWS has a timing issue where Function URLs created with RESPONSE_STREAM invoke mode require permissions to be fully propagated before the URL becomes accessible. The previous implementation created the Function URL before the required permissions, causing a race condition.

Solution

Reordered the resource creation sequence to create permissions before the Function URL:

1. Create permissions first: Both lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions
2. Create Function URL after: With explicit dependencies on the permissions using sdk.DependsOn()
3. Ensure proper ordering: Pulumi now waits for permissions to be created before creating the Function URL

Changes Made

• Moved permission creation before Function URL creation in the LambdaRoutingFunctionUrl code path
• Captured permission resources to use as dependencies (urlPermission, invokePermission)
• Added explicit dependencies to Function URL creation using sdk.DependsOn([]sdk.Resource{urlPermission, invokePermission})
• Enhanced logging to show invoke mode during Function URL creation

Impact

• ✅ No more 403 errors with RESPONSE_STREAM invoke mode on first deployment
• ✅ No manual console intervention required - Function URLs work immediately
• ✅ Both invoke modes supported - BUFFERED and RESPONSE_STREAM work correctly
• ✅ Backward compatible - existing BUFFERED mode deployments unaffected

Testing

• Verified with Forge application using lambdaInvokeMode: RESPONSE_STREAM
• Confirmed Function URLs are accessible immediately after deployment
• Tested both streaming and buffered invoke modes

Files Modified

• pkg/clouds/pulumi/aws/aws_lambda.go - Reordered Function URL creation sequence

This fix resolves the timing issue that was causing 403 Forbidden errors with AWS Lambda Function URLs using response streaming mode.