“A public, data reaching Web Function produces no finding in any of them.”
AWS shipped a new Lambda resource with auth set to none. Every role holding lambda:* already has the new actions. The SCP everyone deployed to block public function URLs does not match the new calls. Access Analyzer, Config and Prowler can’t see it either. Amazon spent years teaching customers to lock this door and then installed a new one without a lock.