APIGateway

An API Gateway API that invokes a Lambda backend is an event source for that Lambda; invoking the API triggers the Lambda.

Changing an integration's credentials field to a more-privileged role (apigateway:PATCH + iam:PassRole) then invoking yields execution as the new role.

An API Gateway integration's credentials field references an IAM role; reading the integration config reveals which role the API uses as its execution identity.

Invoking an API Gateway API whose integration ExecutesAs a credentials role runs the integration as that role, yielding CanExecuteAs.

API Gateway invokes a Lambda authorizer function to evaluate access on every request (TOKEN or REQUEST type).

Modifying a REST API resource policy (apigateway:PATCH/PUT) to grant execute-api:Invoke to external principals or Principal '*'.

A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.

A principal with App Mesh route/service write actions can modify the Envoy xDS configuration delivered to mesh sidecars, redirecting in-mesh or inbound gateway traffic to an attacker-controlled virtual node (traffic hijack within the mesh).

A VPC Lattice service network or service with authType NONE is accessible to any client in any associated VPC without IAM authentication - account-scoped exposure (or broader if the network is RAM-shared).

vpc-lattice:UpdateServiceNetwork or vpc-lattice:UpdateService with authType=NONE disables auth policy evaluation, making all services in the network (or the individual service) invocable by any connected-VPC client without IAM authentication.

vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*, disable auth type).