azure-appsvc-invoke-function-controlplane
Invoke an HTTP-triggered function directly via the control-plane action, without ever listing a function key.
match (effective permission)
{
"action": [
"Microsoft.Web/sites/functions/action",
"Microsoft.Web/sites/hostruntime/host/action"
],
"scope_type": "resource|resourceGroup|subscription"
}
where
site is a Function App with an HTTP-triggered function
network path to the function host (*.azurewebsites.net or private endpoint) exists
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <ServerlessFunction (HTTP-triggered function)> |
| permissions | Microsoft.Web/sites/functions/action Microsoft.Web/sites/hostruntime/host/action |
| conditions | network_reachability trigger_exists |
Narrative
{principal.name} can invoke HTTP function {target.name} via the control plane (sites/functions/action / hostruntime/host/action), causing it to run as the app's managed identity.
Raw rule rules/derived/azure/appservice.yaml
id: azure-appsvc-invoke-function-controlplane
emits: CanInvoke
description: Invoke an HTTP-triggered function directly via the control-plane action, without ever listing
a function key.
match_effective_permission:
action:
- Microsoft.Web/sites/functions/action
- Microsoft.Web/sites/hostruntime/host/action
scope_type: resource|resourceGroup|subscription
where:
- site is a Function App with an HTTP-triggered function
- network path to the function host (*.azurewebsites.net or private endpoint) exists
emit:
source_type: Identity
source: <principal>
target: <ServerlessFunction (HTTP-triggered function)>
permissions:
- Microsoft.Web/sites/functions/action
- Microsoft.Web/sites/hostruntime/host/action
conditions:
- network_reachability
- trigger_exists
false_positive_note: 'Control-plane invoke path independent of the function-key CanReadSecret chain:
sites/functions/action (or hostruntime/host/action) lets the caller invoke without listing a key.
Only HTTP-triggered functions are directly invocable; honor access restrictions / private endpoint
on the site.'
narrative: '{principal.name} can invoke HTTP function {target.name} via the control plane (sites/functions/action
/ hostruntime/host/action), causing it to run as the app''s managed identity.'