Providers
Native resource types mapped to the RAGE taxonomy, their collection recipes, and the fact recipes that back edges. Switch cloud:
What's modeled
90 services · 106 resource types · 10 clustersWhat RAGE covers for AWS today, grouped by the kind of thing each service is.
Data
17Structured data services - relational/NoSQL databases, warehouses, caches, search and analytics stores holding queryable data.
AthenaBedrockDocumentDBDynamoDBElastiCacheEMRKeyspacesLake FormationMemoryDBNeptuneOpenSearchQLDBQuickSightRDS/AuroraRedshiftSageMakerTimestream
ManagementService
17Control-plane & security services whose abuse enables execution, persistence, or evasion.
AWS ConfigCloudFormationCloudTrailCloudWatch/LogsCodeDeployControl TowerDetectiveFirewall ManagerGuardDutyIAM Access AnalyzerIAM Identity CenterInspectorMacieOpsWorksSageMakerSecurity HubService Catalog
Compute
15Resources that execute attacker-influenceable code and usually run AS an identity.
AmplifyApp RunnerBatchCodeBuildEC2EC2 Auto ScalingEC2 Image BuilderECS/FargateEKSElastic BeanstalkGlueLambdaLightsailSageMakerSystems Manager
Messaging
12Integration primitives that can trigger execution or carry credentials.
Amazon MQAPI GatewayAppFlowCodePipelineData PipelineEventBridgeKinesisMSK (Kafka)SageMakerSNSSQSStep Functions
Network
12Connectivity and reachability primitives (networks, subnets, firewalls, routes, endpoints) that gate whether one resource can reach another.
App MeshCloudFrontDirect ConnectEC2ELB/ALB/NLBGlobal AcceleratorNetwork FirewallRoute 53Transit GatewayVPCVPC LatticeWAF/Shield
Storage
8Durable data-at-rest stores - objects, files, blocks, snapshots, backups, and artifact/image repositories an attacker reads, writes, or exfiltrates.
AWS BackupCodeArtifactCodeCommitEBSECREFSFSxS3
Secret
7Credential and cryptographic material - terminal targets and pivots.
ACM Private CACertificate ManagerCloudHSMIAMKMSSecrets ManagerSSM Parameter Store
Identity
4Any principal that can hold permissions or be authenticated as.
CognitoDirectory ServiceIAMIAM Roles Anywhere
AdministrativeBoundary
2Containers that scope permissions, policy inheritance, and control.
Account ManagementOrganizations
Policy
2Authorization & governance artifacts. Nodes so their mutation is an edge target.
IAMResource Access Manager
Resource types 106
| resource | maps to | scope | enumerate | permissions |
|---|---|---|---|---|
aws:accessanalyzer:analyzer |
SecurityService |
regional | access-analyzer:ListAnalyzers |
access-analyzer:ListAnalyzers |
aws:account:region |
Account |
global | account:ListRegions |
account:ListRegions |
aws:acm:certificate |
Certificate |
regional | acm:ListCertificates |
acm:ListCertificates |
aws:acmpca:certificate-authority |
SigningKey |
regional | acm-pca:ListCertificateAuthorities |
acm-pca:ListCertificateAuthorities |
aws:amplify:app |
ApplicationPlatform |
regional | amplify:ListApps |
amplify:ListApps |
aws:apigateway:rest-api |
APIGateway |
regional | apigateway:GET |
apigateway:GET |
aws:appflow:flow |
Workflow |
regional | appflow:ListFlows |
appflow:ListFlows |
aws:appmesh:mesh |
GenericNetwork |
regional | appmesh:ListMeshes |
appmesh:ListMeshes |
aws:apprunner:service |
ApplicationPlatform |
regional | apprunner:ListServices |
apprunner:ListServices |
aws:athena:workgroup |
AnalyticsService |
regional | athena:ListWorkGroups |
athena:ListWorkGroups |
aws:autoscaling:auto-scaling-group |
GenericCompute |
regional | autoscaling:DescribeAutoScalingGroups |
autoscaling:DescribeAutoScalingGroups |
aws:backup:vault |
Backup |
regional | backup:ListBackupVaults |
backup:ListBackupVaults |
aws:batch:job-queue |
BatchJob |
regional | batch:DescribeJobQueues |
batch:DescribeJobQueues |
aws:beanstalk:environment |
ApplicationPlatform |
regional | beanstalk:DescribeEnvironments |
elasticbeanstalk:DescribeEnvironments |
aws:bedrock:custom_model |
MLModel |
regional | bedrock:ListCustomModels |
bedrock:ListCustomModels |
aws:cloudformation:stack |
AutomationService |
regional | cloudformation:DescribeStacks |
cloudformation:DescribeStacks |
aws:cloudfront:distribution |
LoadBalancer |
global | cloudfront:ListDistributions |
cloudfront:ListDistributions |
aws:cloudhsm:cluster |
EncryptionKey |
regional | cloudhsm:DescribeClusters |
cloudhsm:DescribeClusters |
aws:cloudtrail:trail |
LoggingService |
regional | cloudtrail:DescribeTrails |
cloudtrail:DescribeTrails |
aws:cloudwatch:log_group |
LoggingService |
regional | cloudwatch:DescribeLogGroups |
logs:DescribeLogGroups |
aws:codeartifact:repository |
ArtifactRepository |
regional | codeartifact:ListRepositories |
codeartifact:ListRepositories |
aws:codebuild:project |
BuildWorker |
regional | codebuild:ListProjects |
codebuild:ListProjects codebuild:BatchGetProjects |
aws:codecommit:repository |
ArtifactRepository |
regional | codecommit:ListRepositories |
codecommit:ListRepositories |
aws:codedeploy:application |
AutomationService |
regional | codedeploy:ListApplications |
codedeploy:ListApplications |
aws:codepipeline:pipeline |
Workflow |
regional | codepipeline:ListPipelines |
codepipeline:ListPipelines |
aws:cognito:user_pool |
FederatedIdentity |
regional | cognito:ListUserPools |
cognito-idp:ListUserPools |
aws:config:config-rule |
ConfigurationService |
regional | config:DescribeConfigRules |
config:DescribeConfigRules |
aws:controltower:landing_zone |
GenericManagement |
regional | controltower:ListLandingZones |
controltower:ListLandingZones |
aws:datapipeline:pipeline |
Workflow |
regional | datapipeline:ListPipelines |
datapipeline:ListPipelines |
aws:detective:graph |
SecurityService |
regional | detective:ListGraphs |
detective:ListGraphs |
aws:directconnect:connection |
VPN |
regional | directconnect:DescribeConnections |
directconnect:DescribeConnections |
aws:documentdb:db_cluster |
NoSQLDatabase |
regional | documentdb:DescribeDBClusters |
rds:DescribeDBClusters |
aws:ds:directory |
FederatedIdentity |
regional | ds:DescribeDirectories |
ds:DescribeDirectories |
aws:dynamodb:table |
NoSQLDatabase |
regional | dynamodb:ListTables |
dynamodb:ListTables |
aws:ebs:snapshot |
Snapshot |
regional | ebs:DescribeSnapshots |
ec2:DescribeSnapshots |
aws:ec2:instance |
VirtualMachine |
regional | ec2:DescribeInstances |
ec2:DescribeInstances |
aws:ec2:network-interface |
NetworkInterface |
region | ec2:DescribeNetworkInterfaces |
ec2:DescribeNetworkInterfaces |
aws:ec2:route-table |
Route |
region | ec2:DescribeRouteTables |
ec2:DescribeRouteTables |
aws:ec2:security-group |
SecurityGroup |
region | ec2:DescribeSecurityGroups |
ec2:DescribeSecurityGroups |
aws:ec2:subnet |
Subnet |
region | ec2:DescribeSubnets |
ec2:DescribeSubnets |
aws:ec2:vpc-endpoint |
PrivateEndpoint |
region | ec2:DescribeVpcEndpoints |
ec2:DescribeVpcEndpoints |
aws:ecr:repository |
ContainerRegistry |
regional | ecr:DescribeRepositories |
ecr:DescribeRepositories |
aws:ecs:cluster |
ContainerCluster |
regional | ecs:ListClusters |
ecs:ListClusters |
aws:efs:filesystem |
FileStorage |
regional | elasticfilesystem:DescribeFileSystems |
elasticfilesystem:DescribeFileSystems |
aws:eks:cluster |
KubernetesCluster |
regional | eks:ListClusters |
eks:ListClusters |
aws:elasticache:cache_cluster |
Cache |
regional | elasticache:DescribeCacheClusters |
elasticache:DescribeCacheClusters |
aws:elb:load_balancer |
LoadBalancer |
regional | elasticloadbalancing:DescribeLoadBalancers |
elasticloadbalancing:DescribeLoadBalancers |
aws:emr:cluster |
AnalyticsService |
regional | elasticmapreduce:ListClusters |
elasticmapreduce:ListClusters |
aws:eventbridge:event_bus |
EventBus |
regional | eventbridge:ListEventBuses |
events:ListEventBuses |
aws:firewallmanager:policy |
SecurityService |
regional | firewallmanager:ListPolicies |
fms:ListPolicies |
aws:fsx:file_system |
FileStorage |
regional | fsx:DescribeFileSystems |
fsx:DescribeFileSystems |
aws:globalaccelerator:accelerator |
PublicEndpoint |
global | globalaccelerator:ListAccelerators |
globalaccelerator:ListAccelerators |
aws:glue:job |
BatchJob |
regional | glue:GetJobs |
glue:GetJobs |
aws:guardduty:detector |
SecurityService |
regional | guardduty:ListDetectors |
guardduty:ListDetectors |
aws:iam:access-key |
AccessKey |
global | iam:ListAccessKeys |
iam:ListAccessKeys |
aws:iam:group |
Group |
global | iam:ListGroups |
iam:ListGroups |
aws:iam:policy |
IAMPolicy |
global | iam:ListPolicies |
iam:ListPolicies |
aws:iam:role |
Role |
global | iam:ListRoles |
iam:ListRoles |
aws:iam:user |
HumanIdentity |
global | iam:ListUsers |
iam:ListUsers |
aws:imagebuilder:image_pipeline |
BuildWorker |
regional | imagebuilder:ListImagePipelines |
imagebuilder:ListImagePipelines |
aws:inspector:finding |
SecurityService |
regional | inspector:ListFindings |
inspector2:ListFindings |
aws:keyspaces:keyspace |
NoSQLDatabase |
regional | cassandra:Select |
cassandra:Select |
aws:kinesis:stream |
Queue |
regional | kinesis:ListStreams |
kinesis:ListStreams |
aws:kms:key |
EncryptionKey |
regional | kms:ListKeys |
kms:ListKeys |
aws:lakeformation:resource |
DataLake |
regional | lakeformation:ListResources |
lakeformation:ListResources |
aws:lambda:function |
ServerlessFunction |
regional | lambda:ListFunctions |
lambda:ListFunctions lambda:GetFunction |
aws:lightsail:instance |
VirtualMachine |
regional | lightsail:GetInstances |
lightsail:GetInstances |
aws:macie:classification-job |
SecurityService |
regional | macie:ListClassificationJobs |
macie2:ListClassificationJobs |
aws:memorydb:cluster |
Cache |
regional | memorydb:DescribeClusters |
memorydb:DescribeClusters |
aws:mq:broker |
Queue |
regional | mq:ListBrokers |
mq:ListBrokers |
aws:msk:cluster |
Queue |
regional | msk:ListClustersV2 |
kafka:ListClustersV2 |
aws:neptune:db_cluster |
NoSQLDatabase |
regional | neptune:DescribeDBClusters |
rds:DescribeDBClusters |
aws:networkfirewall:firewall |
Firewall |
regional | network-firewall:ListFirewalls |
network-firewall:ListFirewalls |
aws:opensearch:domain |
SearchService |
regional | es:ListDomainNames |
es:ListDomainNames |
aws:opsworks:stack |
AutomationService |
regional | opsworks:DescribeStacks |
opsworks:DescribeStacks |
aws:organizations:account |
Account |
global | organizations:ListAccounts |
organizations:ListAccounts |
aws:qldb:ledger |
GenericData |
regional | qldb:ListLedgers |
qldb:ListLedgers |
aws:quicksight:dashboard |
AnalyticsService |
regional | quicksight:ListDashboards |
quicksight:ListDashboards |
aws:ram:resource_share |
ResourcePolicy |
regional | ram:GetResourceShares |
ram:GetResourceShares |
aws:rds:db_instance |
RelationalDatabase |
regional | rds:DescribeDBInstances |
rds:DescribeDBInstances |
aws:redshift:cluster |
DataWarehouse |
regional | redshift:DescribeClusters |
redshift:DescribeClusters |
aws:rolesanywhere:trust-anchor |
FederatedIdentity |
regional | rolesanywhere:ListTrustAnchors |
rolesanywhere:ListTrustAnchors |
aws:route53:hosted_zone |
DNS |
global | route53:ListHostedZones |
route53:ListHostedZones |
aws:s3:bucket |
ObjectStorage |
global | s3:ListBuckets |
s3:ListAllMyBuckets |
aws:sagemaker:model |
MLModel |
regional | sagemaker:ListModels |
sagemaker:ListModels |
aws:sagemaker:notebook-instance |
Notebook |
regional | sagemaker:ListNotebookInstances |
sagemaker:ListNotebookInstances |
aws:sagemaker:notebook-lifecycle-config |
GenericManagement |
regional | sagemaker:ListNotebookInstanceLifecycleConfigs |
sagemaker:ListNotebookInstanceLifecycleConfigs |
aws:sagemaker:pipeline |
Workflow |
regional | sagemaker:ListPipelines |
sagemaker:ListPipelines |
aws:sagemaker:processing-job |
BatchJob |
regional | sagemaker:ListProcessingJobs |
sagemaker:ListProcessingJobs |
aws:sagemaker:studio-lifecycle-config |
GenericManagement |
regional | sagemaker:ListStudioLifecycleConfigs |
sagemaker:ListStudioLifecycleConfigs |
aws:sagemaker:training-job |
BatchJob |
regional | sagemaker:ListTrainingJobs |
sagemaker:ListTrainingJobs |
aws:sagemaker:transform-job |
BatchJob |
regional | sagemaker:ListTransformJobs |
sagemaker:ListTransformJobs |
aws:secretsmanager:secret |
Secret |
regional | secretsmanager:ListSecrets |
secretsmanager:ListSecrets |
aws:securityhub:standard |
SecurityService |
regional | securityhub:GetEnabledStandards |
securityhub:GetEnabledStandards |
aws:servicecatalog:portfolio |
AutomationService |
regional | servicecatalog:ListPortfolios |
servicecatalog:ListPortfolios |
aws:sns:topic |
Topic |
regional | sns:ListTopics |
sns:ListTopics |
aws:sqs:queue |
Queue |
regional | sqs:ListQueues |
sqs:ListQueues |
aws:ssm-params:parameter |
Secret |
regional | ssm:DescribeParameters |
ssm:DescribeParameters |
aws:ssm:managed-instance |
VirtualMachine |
regional | ssm:DescribeInstanceInformation |
ssm:DescribeInstanceInformation |
aws:sso:instance |
GenericManagement |
regional | sso:ListInstances |
sso:ListInstances |
aws:stepfunctions:state_machine |
Workflow |
regional | states:ListStateMachines |
states:ListStateMachines |
aws:tgw:transit-gateway |
TransitGateway |
regional | ec2:DescribeTransitGateways |
ec2:DescribeTransitGateways |
aws:timestream:database |
GenericData |
regional | timestream:ListDatabases |
timestream:ListDatabases |
aws:vpc:vpc |
VirtualNetwork |
regional | vpc:DescribeVpcs |
ec2:DescribeVpcs |
aws:vpclattice:service-network |
GenericNetwork |
regional | vpc-lattice:ListServiceNetworks |
vpc-lattice:ListServiceNetworks |
aws:waf:web_acl |
Firewall |
regional | waf:ListWebACLs |
wafv2:ListWebACLs |
Fact recipes 8
Facts are the relationship data (policies, bindings, trust, network, credentials) that back edges.
| fact kind | collect | backs edges | permissions |
|---|---|---|---|
identity_policy |
iam:ListRolePolicies + iam:GetRolePolicy (inline) / iam:ListAttachedRolePolicies (managed)over aws:iam:role, aws:iam:user, aws:iam:group |
HasPermission HasPolicy |
iam:ListRolePolicies iam:GetRolePolicy iam:ListAttachedRolePolicies iam:ListUserPolicies iam:GetUserPolicy iam:ListGroupsForUser |
managed_policy |
iam:GetPolicy + iam:GetPolicyVersionover aws:iam:policy |
HasPolicy HasPermission |
iam:GetPolicy iam:GetPolicyVersion iam:ListPolicies |
trust_policy |
iam:GetRole (AssumeRolePolicyDocument)over aws:iam:role |
CanAssume CrossAccountTrust CanFederateAs |
iam:GetRole iam:ListRoles |
resource_policy |
s3:GetBucketPolicy / kms:GetKeyPolicy / secretsmanager:GetResourcePolicy / sns:GetTopicAttributes / sqs:GetQueueAttributes / lambda:GetPolicy / ecr:GetRepositoryPolicyover aws:s3:bucket, aws:kms:key, aws:secretsmanager:secret, aws:sns:topic, aws:sqs:queue, aws:lambda:function, aws:ecr:repository |
HasPolicy CrossAccountTrust ExposedToInternet ExposedToAccount CanReadSecret CanDecrypt CanReadData |
s3:GetBucketPolicy kms:GetKeyPolicy secretsmanager:GetResourcePolicy sns:GetTopicAttributes sqs:GetQueueAttributes lambda:GetPolicy ecr:GetRepositoryPolicy |
scp |
organizations:ListPoliciesForTarget + organizations:DescribePolicyover aws:organizations:account |
organizations:ListPoliciesForTarget organizations:DescribePolicy |
|
membership |
iam:GetGroupover aws:iam:group |
MemberOf |
iam:GetGroup iam:ListGroupsForUser |
network_rule |
ec2:DescribeSecurityGroups + ec2:DescribeNetworkInterfacesover aws:ec2:security-group, aws:ec2:network-interface |
CanNetworkReach CanReachPort ExposedToInternet PrivateReachability |
ec2:DescribeSecurityGroups ec2:DescribeNetworkInterfaces ec2:DescribeSubnets ec2:DescribeRouteTables |
credential |
iam:ListAccessKeysover aws:iam:user |
CredentialsFor ExposesCredential |
iam:ListAccessKeys |
Least-privilege permission set
Every enumerate permission this cloud's resource recipes require - copy as a single collector policy.
access-analyzer:ListAnalyzers account:ListRegions acm-pca:ListCertificateAuthorities acm:ListCertificates amplify:ListApps apigateway:GET appflow:ListFlows appmesh:ListMeshes apprunner:ListServices athena:ListWorkGroups autoscaling:DescribeAutoScalingGroups backup:ListBackupVaults batch:DescribeJobQueues bedrock:ListCustomModels cassandra:Select cloudformation:DescribeStacks cloudfront:ListDistributions cloudhsm:DescribeClusters cloudtrail:DescribeTrails codeartifact:ListRepositories codebuild:BatchGetProjects codebuild:ListProjects codecommit:ListRepositories codedeploy:ListApplications codepipeline:ListPipelines cognito-idp:ListUserPools config:DescribeConfigRules controltower:ListLandingZones datapipeline:ListPipelines detective:ListGraphs directconnect:DescribeConnections ds:DescribeDirectories dynamodb:ListTables ec2:DescribeInstances ec2:DescribeNetworkInterfaces ec2:DescribeRouteTables ec2:DescribeSecurityGroups ec2:DescribeSnapshots ec2:DescribeSubnets ec2:DescribeTransitGateways ec2:DescribeVpcEndpoints ec2:DescribeVpcs ecr:DescribeRepositories ecs:ListClusters eks:ListClusters elasticache:DescribeCacheClusters elasticbeanstalk:DescribeEnvironments elasticfilesystem:DescribeFileSystems elasticloadbalancing:DescribeLoadBalancers elasticmapreduce:ListClusters es:ListDomainNames events:ListEventBuses fms:ListPolicies fsx:DescribeFileSystems globalaccelerator:ListAccelerators glue:GetJobs guardduty:ListDetectors iam:ListAccessKeys iam:ListGroups iam:ListPolicies iam:ListRoles iam:ListUsers imagebuilder:ListImagePipelines inspector2:ListFindings kafka:ListClustersV2 kinesis:ListStreams kms:ListKeys lakeformation:ListResources lambda:GetFunction lambda:ListFunctions lightsail:GetInstances logs:DescribeLogGroups macie2:ListClassificationJobs memorydb:DescribeClusters mq:ListBrokers network-firewall:ListFirewalls opsworks:DescribeStacks organizations:ListAccounts qldb:ListLedgers quicksight:ListDashboards ram:GetResourceShares rds:DescribeDBClusters rds:DescribeDBInstances redshift:DescribeClusters rolesanywhere:ListTrustAnchors route53:ListHostedZones s3:ListAllMyBuckets sagemaker:ListModels sagemaker:ListNotebookInstanceLifecycleConfigs sagemaker:ListNotebookInstances sagemaker:ListPipelines sagemaker:ListProcessingJobs sagemaker:ListStudioLifecycleConfigs sagemaker:ListTrainingJobs sagemaker:ListTransformJobs secretsmanager:ListSecrets securityhub:GetEnabledStandards servicecatalog:ListPortfolios sns:ListTopics sqs:ListQueues ssm:DescribeInstanceInformation ssm:DescribeParameters sso:ListInstances states:ListStateMachines timestream:ListDatabases vpc-lattice:ListServiceNetworks wafv2:ListWebACLs