Skip to content

rage.fail

Taxonomy

10 node classes and 105 node types; 80 edge types in 9 categories. Every identifier is a link.

Open the class × class matrix All edge types

Edge states

A scale from realized to neutralized. Edges carry one of these.

ACTIVE	All preconditions satisfied now; directly traversable.
CONDITIONAL	Traversable only if listed conditions hold (e.g. trigger exists, network reachable).
POTENTIAL	Capability could be created by the source (e.g. can add a trigger) but is not yet realized.
BLOCKED	An explicit deny / guardrail (SCP, deny assignment, deny policy, boundary) neutralizes it.
UNKNOWN	Insufficient collection to decide; surfaced for analyst review, excluded from default paths.

Node classes → types

Identity

13 types

Any principal that can hold permissions or be authenticated as.

AnonymousIdentityApplicationIdentityExternalIdentityFederatedIdentityGenericIdentityGroupHumanIdentityMachineIdentityManagedIdentityRoleServiceAccountServiceIdentityWorkloadIdentity

AdministrativeBoundary

11 types

Containers that scope permissions, policy inheritance, and control.

AccountCloudProviderFolderGenericBoundaryManagementGroupNamespaceOrganizationProjectResourceGroupSubscriptionTenant

Compute

13 types

Resources that execute attacker-influenceable code and usually run AS an identity.

ApplicationPlatformBatchJobBuildWorkerContainerContainerClusterContainerServiceContainerTaskGenericComputeKubernetesClusterKubernetesWorkloadNotebookServerlessFunctionVirtualMachine

Storage

8 types

Durable data-at-rest stores - objects, files, blocks, snapshots, backups, and artifact/image repositories an attacker reads, writes, or exfiltrates.

ArtifactRepositoryBackupBlockStorageContainerRegistryFileStorageGenericStorageObjectStorageSnapshot

Data

9 types

Structured data services - relational/NoSQL databases, warehouses, caches, search and analytics stores holding queryable data.

AnalyticsServiceCacheDataLakeDataWarehouseGenericDataMLModelNoSQLDatabaseRelationalDatabaseSearchService

Messaging

10 types

Integration primitives that can trigger execution or carry credentials.

APIAPIGatewayEventBusEventRuleGenericMessagingQueueSchedulerTopicWebhookWorkflow

Secret

12 types

Credential and cryptographic material - terminal targets and pivots.

AccessKeyAPIKeyCertificateConnectionStringCredentialEncryptionKeyGenericSecretPasswordSecretSigningKeySSHKeyToken

Network

15 types

Connectivity and reachability primitives (networks, subnets, firewalls, routes, endpoints) that gate whether one resource can reach another.

DNSFirewallGenericNetworkLoadBalancerNATNetworkInterfacePeeringPrivateEndpointPublicEndpointRouteSecurityGroupSubnetTransitGatewayVirtualNetworkVPN

Policy

8 types

Authorization & governance artifacts. Nodes so their mutation is an edge target.

ConditionalPolicyGenericPolicyIAMPolicyOrganizationPolicyPermissionBoundaryResourcePolicyServiceControlPolicyTrustPolicy

ManagementService

6 types

Control-plane & security services whose abuse enables execution, persistence, or evasion.

AutomationServiceConfigurationServiceGenericManagementLoggingServiceRemoteManagementServiceSecurityService

Edge categories → types

structural

3 edges · STRUCTURAL

Inventory/containment. Not attack-traversable by default.

AttachedToContainsLocatedIn

identity_authz

14 edges · AUTHORIZATION

Membership, roles, permission grants, trust & policy mutation.

CanAddMemberCanAssumeCanDelegateCanFederateAsCanGrantPermissionCanImpersonateCanModifyPolicyCanModifyTrustCanPassIdentityCanRemoveMemberHasPermissionHasPolicyHasRoleMemberOf

execution

13 edges · EXECUTION

Causing attacker-controlled code to run as some identity.

CanAttachIdentityCanCreateWorkloadAsCanDeployCanExecuteAsCanExecuteCommandCanExecuteOnCanInvokeCanModifyCodeCanModifyConfigurationCanScheduleCanStartCanTriggerExecutesAs

credential

11 edges · CREDENTIAL

Reading/creating/using credential & key material.

CanCreateCredentialForCanCreateKeyCanDecryptCanExportKeyCanReadCredentialCanReadSecretCanResetCredentialCanRetrieveTokenCanSignAsCredentialsForExposesCredential

resource_control

9 edges · CONTROL

Read/write/admin/ownership over resources.

CanAdministerCanControlCanCreateCanDeleteCanModifyCanReadCanReplaceCanTakeOwnershipCanWrite

network

8 edges · NETWORK

Reachability & exposure.

CanNetworkReachCanReachPortExposedToAccountExposedToInternetExposedToTenantPeeredWithPrivateReachabilityRoutesTo

data

7 edges · STRUCTURAL, CREDENTIAL, CONTROL

Data-plane access & exfiltration.

CanDeleteDataCanExfiltrateCanReadDataCanWriteDataContainsCredentialContainsResourceReferenceContainsSecret

cross_boundary

13 edges · AUTHORIZATION, CREDENTIAL, CONTROL

Movement across accounts/projects/subs/tenants/orgs.

AuthenticatesToCanEnterAccountCanEnterOrganizationCanEnterProjectCanEnterSubscriptionCanEnterTenantCredentialValidForCrossAccountTrustCrossProjectTrustCrossTenantTrustExternalIdentityMapsToFederatesToTrustsExternalIdentity

derived

2 edges · DERIVED_ATTACK_PATH

Computed capability summarizing a multi-edge chain.

CanEscalateToControls