DataForge exposes a small internal admin tool via a Lambda function URL. They must restrict access so only callers from their AWS Organization can invoke it and require SigV4 authentication. They do not want to add API Gateway. What should they do?

The correct solution is to set the function URL's AuthType to AWSIAM and apply a resource-based policy. This policy should explicitly allow the lambda:InvokeFunctionUrl action only when the aws:PrincipalOrgID condition matches the organization's ID. This configuration enforces SigV4 authentication, ensuring that only authenticated identities from the specified AWS Organization can invoke the function, directly addressing both requirements without needing API Gateway. Using a Cognito user pool authorizer would require managing user identities and authentication outside of AWS IAM, which is not specified and adds complexity. Enabling API keys does not provide SigV4 authentication and is less secure for internal tools. Configuring AuthType=NONE makes the function publicly accessible, and CORS only restricts browser-based access, not direct invocation, failing to meet the security requirements.