Public Lambda function URLs need two resource-policy permissions

A Lambda function URL with auth type NONE returns 403 Forbidden if the resource policy only allows lambda:InvokeFunctionUrl (condition lambda:FunctionUrlAuthType=NONE). It must also allow lambda:InvokeFunction for principal * with condition lambda:InvokedViaFunctionUrl=true. Fix: aws lambda add-permission --function-name <FN> --statement-id public-invoke --action lambda:InvokeFunction --principal "*" --invoked-via-function-url. Check with aws lambda get-policy for both statements before debugging anything else.