emfirge_attack_paths
Query the modeled graph for internet-to-internal paths, chokepoints, and orphaned resources as one view of cloud consequences.
Parameters
analysis_id: string · required
{ "analysis_id": "7f3c9a2e-4b1d-4c8a-9f2e-1a2b3c4d5e6f" }
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"paths": [{ "finding_id": "EMFIRGE-EC2-002", "finding_title": "SSH port 22 is open to the entire internet (0.0.0.0/0)", "severity": "critical", "path": ["NAME_132", "NAME_140", "iam-role-AppServerRole", "acme-prod-customers"] }],
"critical_resources": [{ "node_id": "acme-prod-customers", "label": "RDS: acme-prod-customers", "type": "rds_instance", "finding_count": 6, "max_severity": "Critical", "blast_radius": 22, "centrality": 0.15415, "exploit_distance": 6 }],
"orphaned_resources": [{ "id": "NAME_154", "type": "ebs_volume", "label": "EBS: 50GB", "estimated_monthly_cost": 5, "reason": "Unattached EBS volume (available state)" }],
"stats": { "total_nodes": 53, "total_edges": 88, "orphaned_count": 6, "estimated_monthly_waste": 43.65, "node_types": {}, "edge_types": {} }
}
Validation, behavior, and limits
Each path contains finding_id, finding_title, severity, and path, an ordered array of node IDs. Paths are ranked by exploit difficulty.
critical_resources identify crown jewels with node_id, label, type, finding_count, max_severity, blast_radius, centrality, and exploit_distance. High-centrality entries are chokepoints where hardening one resource severs the most paths.
orphaned_resources and stats round out the graph. stats contains total_nodes, total_edges, orphaned_count, estimated_monthly_waste, node_types, and edge_types. Some node IDs are raw graph labels rather than NAME_### tokens. Feed a chokepoint into verify_fix to test whether hardening collapses paths.