Lenses and coverage
Evaluate different consequences over the same infrastructure model, with explicit bounds on every conclusion.
Security and reachability
The native engine evaluates findings and graph relationships, including internet-reachable resources and privilege-escalation signals. Attack paths and blast radius help explain effects beyond a single changed resource.
These are graph-based predictions. They are not live exploit execution or a complete evaluation of every IAM and network policy.
IAM privilege escalation uses the public pathfinding.cloud catalogue, and IAM access levels come from policy_sentry. If policy_sentry is unavailable, the verdict is marked degraded rather than silently passing.
Rules include trust policies open to anyone or to another account (EMFIRGE-IAM-009), internet-reachable resources with broad data access (EMFIRGE-IAM-008), and wildcard S3 grants. S3 buckets made public by a bucket policy, not only by ACLs, are detected using AWS's definition of public. Block Public Access settings, on the bucket and the account, are collected and respected. A public bucket policy on a bucket with BlockPublicPolicy on is rejected with HTTP 422.
A security group rule counts as open on SSH or RDP when its port range, or an all-traffic rule, includes port 22 or 3389, for IPv4 (0.0.0.0/0) or IPv6 (::/0). A publicly accessible RDS instance is internet reachable only when its subnet routes to an internet gateway and an open security group and network ACL path covers its port.
Dependencies and delete safety
When a branch deletes something, this lens asks what breaks. It reports lost dependencies (for example, a role an instance uses or a secret a function references), lost connectivity, and whether a deleted data store still has a recovery point.
A deleted database with no surviving snapshot blocks. A role or resource that was recently used blocks, and so does one whose usage could not be verified.
In-use evidence is opt-in. emfirge_in_use_evidence first shows exactly which CloudTrail and CloudWatch reads it would make and their cost; it reads nothing until you approve. Evidence can only make a verdict stricter.
Compliance
emfirge_check_compliance maps findings to CIS AWS Foundations 1.5 and SOC 2 controls and reports pass, fail, partial, not applicable, or not evaluated per control. Control lists come from Prowler's published compliance data. A control that Emfirge does not cover is never reported as pass, and the response counts how many controls are covered. These are mapped checks, not an audit or certification.
Limits
The limits lens checks deterministic AWS default quotas, such as security-group rules, Elastic IPs, and VPCs per region, and warns when a branch would breach one. It uses AWS default values, not your account’s approved quota increases, and does not forecast.
Configuration checks
The engine serializes supported infrastructure and runs Checkov as an additional configuration lens. In the hosted service Checkov runs in a separate, memory-capped worker, only on changed resources and the resources next to them; results for the base are cached. A combined verdict compares before and after findings. Trivy is off.
Scanner findings are advisory: they warn and do not block on their own, unless the check has a published severity in Emfirge's crosswalk (the crosswalk is empty today). Inspect scanner_status and scanner_loss. Resource types that are not serialized, such as IAM, KMS, CloudTrail, Lambda, and VPC, are listed in scanner_loss and are covered by native rules only.
Provisioned-cost estimates
Prices come from AWS's published Price List for us-east-1 (1393 EC2 instance types, all EBS volume types, NAT gateway and Application Load Balancer fixed hourly charges), with a monthly-hour assumption. The cost output's as_of is the price list's publication date. It reports known provisioned charges and identifies unknown prices or usage-based costs.
Not covered: other regions and Load Balancer Capacity Units (LCUs). Current values are estimates, not your AWS bill. Unsupported prices are not invented.
| Cost basis | Interpretation |
|---|---|
| provisioned-estimate | A supported resource with a known table price |
| usage-based-unknown | Requires actual usage information |
| price-unavailable | No supported price for the resource |
Availability and recovery
Native rules and category scores include infrastructure configuration signals for availability and disaster recovery. These do not predict uptime, failover timing, or whether an application can serve a particular load.
What needs a real run
Application latency, throughput, runtime correctness, recovery time, and usage-based spend require execution or measured telemetry. Emfirge’s model does not produce those measurements.