The infrastructure graph
Explore attack paths, blast radius, chokepoints, and toxic combinations as queries over one graph.
What the graph is
Every scanned resource becomes a node and every relationship a directed edge. The public internet is a first-class node, so reachability is a literal path. The engine models supported service types; coverage is not universal and relationships such as REACHES, uses_iam_role, can_access, REFERENCES_SECRET, and subnet/VPC containment.
Rank routes by effort
Representative edge costs are used for path ranking, not as a universal range or a claim about all path lengths: metadata edges cost 0, normal reachability edges cost 1, selected relationship edges cost 2–3, and unknown relationships fall back to 3. Path ranking uses effort, not simply hop count: a five-hop route of trivial steps can outrank a two-hop route needing a shell and stolen credentials.
| Representative cost | Meaning |
|---|---|
| 0 | Metadata or structural edge; no additional modeled effort |
| 1 | Normal reachability edge |
| 2–3 | Selected relationship edge requiring additional modeled effort |
| 3 | Unknown relationship fallback |
One graph, many queries
Attack paths are ranked by effort. Blast radius is an outbound-only search from a node. Chokepoints use betweenness centrality. Toxic combinations are nine curated multi-signal patterns, and orphaned resources are disconnected nodes often indicating cleanup or cost work.
Rules and limits
The engine runs 51 verified check functions across the supported rule families and produces a 0–100 posture score, higher is safer, across security, availability, cost, and disaster recovery. Path-finding and blast radius are capped at 5 hops. The graph is a scan snapshot, not live AWS; coverage and exploit weights are bounded heuristics.
Typed nodes and edges
Every resource a scan finds becomes a node. Every real relationship becomes a directed edge. The public internet is a first-class node, so internet reachability is a literal path. The engine models supported service types; coverage is not universal.
- internet
- vpc
- subnet
- security_group
- ec2_instance
- load_balancer
- iam_role
- rds_instance
- s3_bucket
- lambda_function
- ecs_tasks
- api_gateway
- elasticache
- dynamodb_table
- cloudfront
- secrets_manager
- kms_key
- sqs_queue
- ebs_volume
- elastic_ip
Relationships and effort weights
Edges encode REACHES (internet to security group), uses_iam_role (instance assuming a role), can_access (role reaching a data store), REFERENCES_SECRET, subnet/VPC containment, and more. Findings hang off the nodes and edges that produced them.
Representative edge costs are used for path ranking, not as a universal range or a claim about all path lengths: metadata edges cost 0, normal reachability edges cost 1, selected relationship edges cost 2–3, and unknown relationships fall back to 3. A five-hop route of trivial steps can outrank a two-hop route needing a shell and stolen credentials.
| Representative cost | Meaning |
|---|---|
| 0 | Metadata or structural edge; no additional modeled effort |
| 1 | Normal reachability edge |
| 2–3 | Selected relationship edge requiring additional modeled effort |
| 3 | Unknown relationship fallback |
Derived queries
Attack paths are weighted shortest-path searches outward from the internet, returning routes to data ranked by effort; this is what emfirge_attack_paths returns.
Blast radius is a directional outbound-only search: if one resource is compromised, everything it could reach next. Inbound edges are ignored, so the result is downstream risk, not what protects the resource.
Chokepoints use betweenness centrality to find nodes on paths between others. Toxic combinations are 9 curated multi-signal patterns. Orphaned resources are disconnected nodes such as unattached EBS volumes or idle elastic IPs, usually cleanup/cost signals.
Service coverage, rules, and scoring
The engine runs 51 verified check functions across the supported rule families: EC2 and security groups, S3, RDS, IAM, Lambda, KMS, VPC, CloudTrail, Config, CloudWatch, GuardDuty, Secrets Manager, SNS, WAF, ECS, cost, and orphaned resources.
Findings roll into a 0–100 scan posture score (higher is safer) across security, availability, cost, and disaster recovery. Severity is context-aware: SSH open behind an ALB is not scored like SSH open to the internet. No LLM runs in scoring. This posture score is distinct from the branch verdict, which evaluates six change lenses.
Graph limits
The graph is a scan snapshot, not live AWS; re-scan after infrastructure changes. Coverage spans multiple AWS service families, so anything outside the supported model cannot appear in paths, blast radius, or chokepoints. Representative edge costs are hand-assigned heuristics, not real-world exploitability measurements. Blast-radius and downstream traversal are capped at 5 hops; blast radius is a downstream reachability count, not proof every step can be chained. The 9 toxic patterns are not exhaustive, and normalized scores are only approximately comparable across very different accounts.