CanTrigger
Source can cause the target to execute (event source, schedule). Includes triggering compute workloads and orchestration workflows. AnalyticsService sources cover analytics engines that invoke compute as part of query execution (e.g. an Athena federated query invoking its Lambda data-source connector).
Identity, Messaging, Storage, Network, AnalyticsService
── CanTrigger ──▸
Compute, Messaging, AnalyticsService
Source types
Target types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws | - | |
| gcp | - | |
| azure | - |
Rules that emit CanTrigger 79
amplify:StartJob fires a build of the branch, running its current buildSpec as the service role.
awsderived
amplify:CreateWebHook creates an unauthenticated HTTP endpoint that triggers a branch build.
awsderived
An API Gateway API that invokes a Lambda backend is an event source for that Lambda; invoking the API triggers the Lambda.
awsderived
API Gateway invokes a Lambda authorizer function to evaluate access on every request (TOKEN or REQUEST type).
awsderived
Auto-deploy service redeploys on upstream ECR push / source commit.
awsderived
A principal with athena:StartQueryExecution on a LAMBDA-catalog workgroup can trigger the registered Lambda connector function.
awsderived
Force an ASG to launch fresh instances so attacker-modified config/identity takes effect.
awsderived
An EventBridge rule / EventBridge Scheduler target or a Step Functions state that calls batch:SubmitJob against a definition is an attacker-reachable execution trigger.
awsderived
Restart/rebuild re-runs deploy hooks (.ebextensions) on the instances.
awsderived
A stack's service role (Identity) triggers the Custom:: resource Lambda during stack lifecycle events via lambda:InvokeFunction; principals who CanExecuteAs the service role inherit this CanTrigger path.
awsderived
codebuild:StartBuild without modifying the buildspec triggers execution of the current (stored) definition.
awsderived
A project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild permission.
awsderived
A CodePipeline BUILD stage action invokes codebuild:StartBuild on the project; the pipeline orchestrates the build trigger.
awsderived
codebuild:CreateWebhook allows a principal to add a new webhook trigger to a project, creating a POTENTIAL trigger surface that activates when qualifying VCS events fire.
awsderived
A CodePipeline Deploy stage action invokes the CodeDeploy deployment group; emit CanTrigger from the pipeline's execution identity so cicd-chains propagates pipeline-level trigger capability.
awsderived
PutApprovalResult APPROVE on a manual approval gate unblocks the downstream stage runner, enabling a principal who can trigger the pipeline AND approve the gate to reach stages that were otherwise CONDITIONAL(stage_reachable).
awsderived
datapipeline:ActivatePipeline starts a pipeline run, completing the execution path when combined with CanModifyCode on the pipeline's definition.
awsderived
datapipeline:SetStatus can force-resume stalled pipeline objects, effectively re-triggering activities - an alternative to ActivatePipeline.
awsderived
An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling trigger-based code execution.
awsderived
A firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS, another bus, etc.) with the event payload.
awsderived
Update a Glue job's ScriptLocation to an attacker-controlled S3 object, establishing the code-modify and trigger facts needed for can-execute-as derivation.
awsderived
Overwrite the S3 object that a Glue job's ScriptLocation references (s3:PutObject), poisoning the ETL code; the next run executes as the job's IAM role.
awsderived
kinesis:PutRecord(s) to a stream with an active Lambda ESM triggers the consumer function with an attacker-influenced record payload.
awsderived
opsworks:CreateDeployment (non-execute_recipes flavors) triggers a deployment with the stack's current cookbook definition - CanTrigger into the instance for cicd-chains rule 2.
awsderived
A confirmed active SNS subscription binds the topic to its consumer; every Publish invokes the consumer with the message payload.
awsderived
ssm:StartAutomationExecution triggers an existing Automation BuildWorker runner that executes as its AutomationAssumeRole.
awsderived
ssm:StartChangeRequestExecution triggers an Automation runbook with Change Manager approval gating.
awsderived
A State Manager association with a cron schedule triggers the bound document against targeted instances automatically.
awsderived
An EventBridge rule with a Step Functions state machine as its target can start an execution when the rule matches; the EventBridge source is the event source, the state machine is the consumer.
awsderived
registries/taskRuns/write queues a manual run of an existing ACR Task - triggers execution of whatever the current task definition specifies as the task's MI.
azurederived
Principal with deployments/write can submit or re-run a deployment, triggering the current template (including any deploymentScript resources) to execute.
azurederived
Start a runbook job in an Automation Account (cloud sandbox or hybrid worker).
azurederived
Holder of a webhook URI (secret token in URL) can trigger a specific runbook job via HTTP POST without ARM RBAC.
azurederived
Create a new webhook for any runbook via automationAccounts/webhooks/write; the attacker receives the webhook URI once and can trigger the runbook.
azurederived
An ADF Storage Events or Custom Events trigger binds a storage/Event Grid source to a pipeline; writing to that source drives the pipeline run.
azurederived
An active Event Grid event subscription binds a topic to a Compute consumer (Azure Function, Logic App, webhook); this is the CanTrigger fact consumed by messaging-chains rule 1.
azurederived
Explicitly trigger a policy remediation task via Microsoft.PolicyInsights/remediations/write; the remediation executes as the assignment's bound MI. This is a direct trigger path that does not require policyAssignments/write if the assignment already has a remediation MI configured.
azurederived
A confirmed event-source binding from a Service Bus queue to a compute consumer (Azure Function serviceBusTrigger, Logic App connector, Container App KEDA scaler) - the Phase-10 binding fact.
azurederived
A confirmed event-source binding from a Service Bus topic subscription to a compute consumer - fan-out trigger fact.
azurederived
Synapse Compute Operator role allows triggering pipeline runs (createPipelineRun) on the workspace, executing whatever pipeline definition is currently published.
azurederived
Synapse Compute Operator can submit Spark batch jobs and interactive sessions directly via the Apache Livy REST API endpoint at <workspace>.dev.azuresynapse.net/livyApi/..., triggering immediate job execution.
azurederived
azurederived
azurederived
Triggering a pipeline reaches each downstream stage runner it orchestrates; propagate CanTrigger to those runners.
derived
cloudbuild.triggers.run lets the principal fire an existing trigger at a chosen source revision; code execution as the trigger's SA is CONDITIONAL on the current definition being attacker-influenced.
gcpderived
A principal with pubsub.topics.publish on a trigger's configured Pub/Sub topic can fire that trigger, potentially executing code as the trigger's SA.
gcpderived
clouddeploy.rollouts.approve unblocks a NEEDS_APPROVAL rollout, triggering the deploy Cloud Build worker (no actAs required).
gcpderived
clouddeploy.automations.create with a promoteReleaseRule or advanceRolloutRule schedules automatic rollout creation, effectively giving CanTrigger over the deploy Cloud Build worker.
gcpderived
A Cloud Scheduler HTTP job binds to a compute target (Cloud Run, Cloud Functions, App Engine, or other HTTP endpoint). The job fires on schedule sending the OIDC/OAuth2 bearer - this is the CanTrigger binding fact consumed by messaging-chains.
gcpderived
A Cloud Scheduler App Engine HTTP job triggers an App Engine service on schedule. App Engine targets are always same-project. OIDC/OAuth2 auth model applies identically to HTTP targets.
gcpderived
composer.environments.executeAirflowCommand lets the principal trigger an existing Airflow DAG run; CanExecuteAs is CONDITIONAL on the current DAG definition being attacker-influenced.
gcpderived
dataproc.workflowTemplates.instantiate directly runs the workflow template, feeding cicd-chains trigger-then-executes-as.
gcpderived
A live Eventarc trigger (state=ACTIVE) routes events from its source to the destination consumer - the event-source-binding fact feeding messaging-chains rules 1 and 2.
gcpderived
Publishing to an Eventarc-managed Pub/Sub transport topic directly triggers the bound destination consumer - collapses the Topic → EventRule → Compute chain into a single CanTrigger(Topic → Compute) for messaging-chains rule 1.
gcpderived
GCR push event fires to the default gcr Pub/Sub topic, triggering any Cloud Build subscription - indirect trigger of build jobs running as the Cloud Build SA.
gcpderived
An object write to a GCS bucket with Pub/Sub notification config pointing to a Cloud Function/Cloud Run service triggers downstream compute execution as the function's service account.
gcpderived
An active push subscription binding its topic's messages to an HTTP endpoint (Cloud Run service / Cloud Function URL) makes the subscription an event-source bridge: messages published to the topic are delivered to the consumer. Consumed by messaging-chains to derive CanTrigger(publisher → consumer).
gcpderived
A Cloud Tasks queue with httpTarget.uri (or an App Engine target) dispatches tasks to its configured consumer HTTP endpoint - the event-source binding fact consumed by messaging-chains rule 1.
gcpderived
cloudtasks.tasks.run immediately force-dispatches an existing task to its configured consumer, bypassing schedule time and rate limits - a direct CanTrigger primitive that requires a suitable task to already exist in the queue.
gcpderived
Publishing/sending to an event source triggers the consumer bound to it (via an event-source-mapping/subscription/rule target) with an attacker-influenced payload.
derived
An Athena workgroup configured with a LAMBDA data catalog triggers the registered Lambda connector function.
awsexplicit
awsexplicit
awsexplicit
opsworks:CreateDeployment can trigger a deployment run using the stack's current cookbook/app definition.
awsexplicit
awsexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
Principal can trigger an existing AML job/pipeline run, executing the current job definition as the cluster MI.
azureexplicit
Principal can invoke a batch endpoint to trigger a batch scoring job on the endpoint's compute cluster.
azureexplicit
azureexplicit
Live Eventarc trigger (state=ACTIVE) routes events to a Cloud Run service destination.
gcpexplicit
Live Eventarc trigger (state=ACTIVE) routes events to a GCP Workflow destination.
gcpexplicit
Live Eventarc trigger (state=ACTIVE) routes events to a Cloud Function destination.
gcpexplicit
Live Eventarc trigger (state=ACTIVE) routes events to a GKE service endpoint.
gcpexplicit
The Eventarc-managed Pub/Sub transport topic backs the trigger's event delivery - connects Topic node to EventRule node for the two-hop chain.
gcpexplicit