rage.fail

azure-appsvc-invoke-function

Invoke an HTTP-triggered function using a function/host key (or anonymous auth).

derived azure emits CanInvoke

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadSecret {'functionKey': None}

where

?functionKey is a function/host key for a Function App function with HTTP trigger OR the function authLevel == anonymous (no key required) network path to the function host (*.azurewebsites.net or private endpoint) exists

emit

source type	`Identity`
source	`<principal>`
target	`<ServerlessFunction (HTTP-triggered function)>`
permissions	`Microsoft.Web/sites/functions/listkeys/action`
conditions	`network_reachability` `trigger_exists`

Narrative

{principal.name} can invoke HTTP function {target.name}, causing it to run as the app's managed identity.

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-invoke-function
emits: CanInvoke
description: Invoke an HTTP-triggered function using a function/host key (or anonymous auth).
match:
- - principal: null
  - CanReadSecret
  - functionKey: null
where:
- ?functionKey is a function/host key for a Function App function with HTTP trigger
- OR the function authLevel == anonymous (no key required)
- network path to the function host (*.azurewebsites.net or private endpoint) exists
emit:
  source_type: Identity
  source: <principal>
  target: <ServerlessFunction (HTTP-triggered function)>
  permissions:
  - Microsoft.Web/sites/functions/listkeys/action
  conditions:
  - network_reachability
  - trigger_exists
  false_positive_note: Only HTTP-triggered functions are directly invocable; timer/queue/blob triggers
    are not. Anonymous functions need no key. Honor access restrictions / private endpoint on the site.
  narrative: '{principal.name} can invoke HTTP function {target.name}, causing it to run as the app''s
    managed identity.'