azure-la-http-trigger-invoke

Invoke a Logic App HTTP trigger using a held callback URL (SAS-signed).

derived azure emits CanInvoke

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Workflow`
source	`<principal>`
target	`<Logic App workflow>`
conditions	`network_reachability`
state logic	ACTIVE when the principal holds the callback URL AND the workflow is Enabled AND network-reachable. CONDITIONAL(network_reachability) if network path is unconfirmed. BLOCKED if the workflow is Disabled or the access key was regenerated after the URL was obtained (URL is now invalid).

source type

Identity

target type

Workflow

source

<principal>

target

<Logic App workflow>

conditions

network_reachability

state logic

ACTIVE when the principal holds the callback URL AND the workflow is Enabled AND network-reachable. CONDITIONAL(network_reachability) if network path is unconfirmed. BLOCKED if the workflow is Disabled or the access key was regenerated after the URL was obtained (URL is now invalid).

Narrative

{principal.name} holds the SAS-signed callback URL for Logic App {target.name}'s HTTP trigger and can invoke the workflow without Entra authentication.

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-http-trigger-invoke
emits: CanInvoke
description: Invoke a Logic App HTTP trigger using a held callback URL (SAS-signed).
match:
- - principal: null
  - CanReadSecret
  - callbackUrl: null
where:
- ?callbackUrl is the HTTP trigger callback URL of a Logic App (?callbackUrl is an APIKey node from rule
  azure-la-callback-url)
emit:
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <Logic App workflow>
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE when the principal holds the callback URL AND the workflow is Enabled AND network-reachable.
    CONDITIONAL(network_reachability) if network path is unconfirmed. BLOCKED if the workflow is Disabled
    or the access key was regenerated after the URL was obtained (URL is now invalid).
  confidence: 0.9
  derived_from:
  - '<CanReadSecret edge: ?principal -> ?callbackUrl>'
  false_positive_note: "The callback URL includes a SAS signature (se/sp/sv/sig parameters) that encodes\
    \ an expiry and the access key. If the workflow's access key is regenerated, all outstanding SAS URLs\
    \ become immediately invalid. Invoke alone only drives the EXISTING workflow definition \u2014 it\
    \ becomes CanExecuteAs only when combined with a definition that has been or can be modified (via\
    \ azure-la-workflow-write-modifycode), or when messaging-trigger-executes-as fires because the workflow\
    \ has a MI. The IP allowlist on the HTTP trigger (accessControl.triggers.allowedCallerIpAddresses)\
    \ gates reachability \u2014 condition network_reachability for allowlisted triggers."
  narrative: '{principal.name} holds the SAS-signed callback URL for Logic App {target.name}''s HTTP trigger
    and can invoke the workflow without Entra authentication.'