CanInvoke
Source can directly invoke the target (completes an ExecutesAs escalation when code already attacker-controlled or config changed). Messaging sources include service-to-service invocations (API Gateway invoking Lambda, EventBridge invoking Lambda, etc.).
Identity, Messaging
── CanInvoke ──▸
ServerlessFunction, API, APIGateway, Workflow, ContainerService
Source types
IdentityMessagingStates
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
lambda:InvokeFunction
|
|
| gcp |
cloudfunctions.functions.invoke run.routes.invoke
|
|
| azure |
function key / invoke
|
Rules that emit CanInvoke 20
awsderived
CodeDeploy invokes the pre/post-traffic hook Lambda function specified in the AppSpec; CreateDeployment on a Lambda-platform group lets the attacker choose which Lambda gets invoked.
awsderived
StartPipelineExecution directly invokes a SageMaker Pipeline, running its steps as the pipeline's execution role.
awsderived
states:StartExecution or states:StartSyncExecution allows a principal to directly start a state machine execution with an attacker-supplied input payload.
awsderived
states:StartSyncExecution allows a principal to directly start a synchronous execution of an Express state machine with an attacker-supplied input payload.
awsderived
A cross-account principal with states:StartExecution on a state machine in another account can directly trigger an execution in that account with an attacker-influenced payload.
awsderived
Invoke an HTTP-triggered function using a function/host key (or anonymous auth).
azurederived
Invoke an HTTP-triggered function directly via the control-plane action, without ever listing a function key.
azurederived
Directly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner or a custom role - NOT Data Factory Contributor).
azurederived
azurederived
Invoke an HTTP-triggered function using a held key (or anonymously).
azurederived
Invoke a Logic App HTTP trigger using a held callback URL (SAS-signed).
azurederived
gcpderived
gcpderived
gcpderived
2nd-gen invoke: run.routes.invoke / roles/run.invoker on the backing Cloud Run service invokes the function.
gcpderived
workflows.executions.create starts a new execution with a caller-supplied argument payload - both a direct invoke AND a publish-to-topic primitive (feeds messaging-chains rule 1).
gcpderived
awsexplicit
awsexplicit
azureexplicit