What a branch can change,
and what it can judge.
Emfirge reads far more of your account than it can change on a branch. This page is the honest line between the two. Anything on the wrong side of it is listed as unmodeled or unknown instead of passing.
Resources a branch can change
Eighteen resource types today.
| Resource type | Add | Modify | Delete | Notes |
|---|---|---|---|---|
ec2_instance | yesadd: yes | yesmodify: yes | yesdelete: yes | |
security_group | yesadd: yes | yesmodify: yes | yesdelete: yes | Attachments derive from instance sg_ids. |
rds_instance | yesadd: yes | yesmodify: yes | yesdelete: yes | |
s3_bucket | yesadd: yes | yesmodify: yes | yesdelete: yes | Public-by-bucket-policy is detected. policy_public is derived from policy. |
lambda_function | yesadd: yes | yesmodify: yes | yesdelete: yes | |
network_acl | yesadd: yes | yesmodify: yes | yesdelete: yes | Modify replaces the complete entries and/or associated_subnet_ids. |
iam_role | yesadd: yes | yesmodify: yes | yesdelete: yes | Modify covers the trust policy. |
iam_role_policy | add: no | yesmodify: yes | delete: no | Replaces the complete access_statements list of an existing role, by role ARN. |
iam_user | yesadd: yes | yesmodify: yes | delete: no | Modify sets the console and access-key flags, or replaces the complete statement list. |
iam_instance_profile | yesadd: yes | modify: no | delete: no | The ID is the instance profile ARN; the one field is role_arn. |
nat_gateway | yesadd: yes | modify: no | delete: no | AWS assigns the ID; subnet_id and connectivity_type are needed. |
route_table | yesadd: yes | yesmodify: yes | delete: no | Modify replaces the complete routes list. New internet-gateway routes need attachment evidence. |
rds_snapshot | yesadd: yes | modify: no | yesdelete: yes | Add is a manual snapshot of an existing database. |
ebs_volume | yesadd: yes | modify: no | yesdelete: yes | size_gb is required for an add. |
ebs_snapshot | add: no | modify: no | yesdelete: yes | |
dynamodb_table | add: no | yesmodify: yes | yesdelete: yes | Modify sets point-in-time recovery or deletion protection. Adding a table is not modeled. |
cloudfront_distribution | add: no | yesmodify: yes | delete: no | Modify changes enabled, aliases, price class, web ACL, origins and cache behaviors. Adding or deleting a distribution is not modeled. |
scheduler_schedule | yesadd: yes | yesmodify: yes | yesdelete: yes | EventBridge Scheduler schedules. |
Most types also carry tags; a tag change replaces the complete user tag set, and aws: tags are kept. The live endpoint GET /branches/capabilities is the authoritative list, and GET /branches/field-catalog lists every settable field with the AWS API member it stands for, taken from AWS's own API models. A value AWS would reject is rejected.
Not modeled.
Every resource type that is not in the table, and every operation left empty in it. A change to one of them is read but not modeled: it is listed as unmodeled and cannot pass.
When emfirge can't model it
Anything not modeled is listed. It never passes quietly.
- A change to an unmodeled type or operation is listed as unmodeled and makes the verdict stricter (
unmodeled_changewarns;unmodeled_deleteblocks). - A missing value AWS requires is flagged
unspecified_values, never filled with a guess. - A source that was not collected is an unknown in the answer, not a silent "nothing found".
- A scanner that did not run is reported as not run;
coverage_warningssays the result is not full coverage.
Lenses and their status
Each lens looks at the branch from one angle. Together they feed the checks.
| Lens | Asks | Status |
|---|---|---|
| Security | Does this expose something, or open a privilege-escalation path? | Live |
| Dependencies | What breaks if this is removed? Is it still in use? Can it be recovered? | Live |
| Compliance | Which CIS AWS Foundations 1.5 and SOC 2 controls flip? Uncovered controls are never pass. These are mapped checks, not an audit. | Live |
| Cost | What does it cost before and after? AWS Price List, us-east-1 only, provisioned charges only, no load-balancer capacity units. | Early |
| Limits | Will it hit an AWS quota? AWS default quotas only, not your approved increases, and no forecasting. | Early |
| Yours | Bring your own evaluator against the same branch. | Planned |
Usage-based cost (data transfer, requests, invocations) is excluded and labelled unknown. Application latency, throughput and runtime correctness need a real run and are not modeled.
What each check is built from
The engine parts and the data behind each of the six checks.
| Check | Engine parts | Data sources |
|---|---|---|
| Data | Dependencies lens: a deleted data store against the snapshots and backups that survive. Recovery points the branch removes: deleted snapshots, backups, versioning or point-in-time recovery turned off. | Your read-only scan: EBS volumes and snapshots, RDS snapshots and backup settings, S3 versioning, DynamoDB tables. |
| Exposure | Security lens: the ingress-rule diff, internet reachability over security groups, network ACLs, route tables and gateways, S3 public access, role trust, RDS default ports. Opt-in IAM Access Analyzer checks, which can only make the verdict stricter. | Your scan. AWS documentation for S3 public access and RDS ports. IAM Access Analyzer, with your role, only after you accept an estimate. |
| Money | Cost lens: provisioned cost before and after, per resource and in total. | The AWS Price List (us-east-1 on-demand prices, vendored). |
| Availability | Dependencies lens: the dependency graph walked up to 10 levels, and lost internal and internet paths. Role permission facts, the CloudFront Host-header fact, schedules turned off or deleted, recent use. | Your scan: network interfaces, IAM role last-used. policy_sentry IAM action data. AWS CloudFront documentation. CloudTrail and CloudWatch evidence over 90 days, opt-in. |
| Control | Security lens: admin access added or removed, privilege-escalation paths added, permissions added, S3 access logging. | pathfinding.cloud (92 escalation paths). policy_sentry IAM action data. Your scan: IAM roles and users, S3 logging. |
| Outside world | A per-service table written by hand (AWS Support, Service Quotas, SES, Route 53 Domains, Marketplace, Savings Plans), and schedule changes. | AWS documentation, one page cited per table entry. Your scan: EventBridge Scheduler schedules. |
The Compliance lens (CIS 1.5 and SOC 2, from Prowler) feeds emfirge context --compliance, and the Limits lens feeds the capacity reason in the verdict. Neither is part of the six checks. Lenses are internals; they are named here so you can see where each answer comes from.
Where the checks come from
Public data where a source exists, kept next to every fact. The few facts with no public source are written by hand, cite the AWS docs, and are tested.
Where the checks come from
privilege-escalation paths, from pathfinding.cloud
| Source | Used for |
|---|---|
| pathfinding.cloud | IAM privilege-escalation paths (92) |
| policy_sentry | IAM access levels and the catalog of actions per service |
| Prowler | CIS 1.5 and SOC 2 control lists, and scanner severities |
| AWS API models and Price List | The field catalog, and provisioned cost |
| Checkov | An advisory configuration scanner on each verdict. It warns; it does not block on its own. Trivy is off. |
The numbers in the chart are counted from the repository, not estimated. Every behavior is pinned by a numbered law, a property test that must always hold; there are 89, numbered L1 to L92 (L37 to L39 are not used). Read the laws.