emfirge_scan
Build the read-only cloud graph that your agent can fork and evaluate across modeled consequences.
Parameters
role_arn: string · required; region: string · required
{
"role_arn": "arn:aws:iam::123456789012:role/EmfirgeReadOnly",
"region": "us-east-1"
}
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"analysis_id": "7f3c9a2e-4b1d-4c8a-9f2e-1a2b3c4d5e6f",
"region_analyzed": "us-east-1",
"overall_risk_score": 3,
"overall_risk_level": "CRITICAL",
"security_score": 18,
"availability_score": 96,
"disaster_recovery_score": 90,
"cost_score": 97,
"simulation_baseline": { "critical_count": 15 },
"critical_risks": [ /* … full finding objects … */ ],
"moderate_risks": [ /* … */ ],
"low_risks": [ /* … */ ],
"toxic_combinations": [ /* … */ ],
"total_resources_scanned": 51
}
Validation, behavior, and limits
Returns an overall_risk_score (0–100, higher is safer), matching overall_risk_level, per-category security_score, availability_score, disaster_recovery_score, and cost_score, plus analysis_id, region_analyzed, simulation_baseline, grouped critical_risks, moderate_risks, and low_risks arrays, toxic_combinations, and total_resources_scanned.
Resource IDs are tokenized to NAME_### by default. The score is deterministic and read-only; there is no separate counts object because tallies live under simulation_baseline. Hold on to analysis_id for get_findings, attack_paths, verify_fix, simulate_breach, and check_compliance.
The result includes the remaining daily quota when available. A real scan takes 30–60 seconds and streams to stay under proxy timeouts. The default limit is five scans per account per local calendar day (override with DAILY_SCAN_LIMIT); 429 means the limit was reached. Other tools use a completed scan and do not consume this budget.